PDF malware analysis — malicious · 9f6b7eb70a59fe9e

MALICIOUS

PDF

44.2 KB Created: 2020-08-07 14:41:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4f321b247839a610a71e21ba6ec28a00 SHA-1: eddf4ede592f1d06a6cb210f11c1227afdde40d7 SHA-256: 9f6b7eb70a59fe9e1cfe1cb38d8e2c33872121f607cdb98375be796396a01072

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one heuristic identifying it as a malicious redirector. The document body text and embedded links suggest a lure to download a 'Basic English grammar workbook'. The primary malicious URL identified is ttraff.ru, which is used to redirect the user to a secondary URL. The PDF structure also indicates a link farm, with many links pointing to Shopify domains, likely for SEO manipulation to increase visibility of the malicious lure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=basic+english+grammar+workbook+azar+pdf
- http://files.albanyems.com/uploads/1/3/0/7/130776795/beruka.pdf
- http://pewezaro.parentsoftransgenderkids.org/uploads/1/3/1/6/131637016/gazilekabukugit.pdf
- http://files.jerseyshorechefs.com/uploads/1/3/1/4/131406427/124f5.pdf
- https://cdn.shopify.com/s/files/1/0435/0623/7604/files/mesidela.pdf
- https://cdn.shopify.com/s/files/1/0448/0499/7271/files/precalculus_stewart.pdf
- https://cdn.shopify.com/s/files/1/0430/3906/4225/files/jobelag.pdf
- https://cdn.shopify.com/s/files/1/0433/7631/2471/files/lawusofuxoto.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/rerotapok.pdf
- https://cdn.shopify.com/s/files/1/0429/1241/5897/files/45284124678.pdf
- https://cdn.shopify.com/s/files/1/0430/3749/1354/files/31187986342.pdf
- https://cdn.shopify.com/s/files/1/0430/0007/0307/files/xubezugemu.pdf
- https://cdn.shopify.com/s/files/1/0428/9524/5475/files/bimigoxutor.pdf
- https://cdn.shopify.com/s/files/1/0431/7085/7122/files/zupizavosuvo.pdf
- https://cdn.shopify.com/s/files/1/0440/2823/1830/files/super_bluetooth_hack_1._08_apk.pdf
- https://cdn.shopify.com/s/files/1/0437/1356/0727/files/mage-_tastic_gizmonitor_vanilla.pdf
- https://cdn.shopify.com/s/files/1/0430/2353/2195/files/69168327120.pdf
- https://cdn.shopify.com/s/files/1/0433/2909/3800/files/lethal_and_sublethal_genes.pdf
- https://cdn.shopify.com/s/files/1/0437/0441/8455/files/67913239807.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f9f.bin` `11ebe285fb4ba0f31ba37e92cff0cf32458052b5dadaf2a5c9b22fd0ac5336df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F9F	5964 bytes
`font_01_sfnt_off000073da.bin` `081957e5b8b6fd1a981b0725430fa6b34979fe12658e3368f742c9ffde350c3a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x73DA	15048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.