Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fc7c4d43e0ce0e7…

MALICIOUS

PDF

45.0 KB Created: 2020-08-09 06:27:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 45c886ea581ae5d8387604cc89b9c531 SHA-1: acf38f649d999f28467a9ab9031a81c32488bb7d SHA-256: 9fc7c4d43e0ce0e70946cc7136e751af5203088565a9212f69ca32330374f104
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links, many of which point to Shopify domains hosting PDF files, suggesting a link farm for SEO manipulation. One critical heuristic identified a link to a known malicious redirector, `https://ttraff.cc/pify?keyword=arenas+movedizas+libro+malin+persson+pdf`, which is likely intended to lead the user to malicious content. The document body itself contains garbled text but also includes the same malicious redirector URL and several Shopify PDF links, reinforcing the lure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=arenas+movedizas+libro+malin+persson+pdf
    • http://pibipur.hypershft.com/uploads/1/3/1/6/131606727/ramenupabek-galokasel-dazaxemesabo.pdf
    • http://files.tropixfx.com/uploads/1/3/1/1/131164281/vexabeliwedilo_xovoxebazamet_tirafirun.pdf
    • http://files.charmingandchair-ished.com/uploads/1/3/1/8/131871583/d058668532.pdf
    • http://files.glimmericks.com/uploads/1/3/0/7/130738765/fumatisagir.pdf
    • http://files.greatcentralwalks.com/uploads/1/3/1/4/131437005/romabaze_pibagapowene.pdf
    • https://cdn.shopify.com/s/files/1/0434/7179/8436/files/90716303345.pdf
    • https://cdn.shopify.com/s/files/1/0431/5178/6135/files/10125020293.pdf
    • https://cdn.shopify.com/s/files/1/0440/6296/5912/files/15495355874.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/56802730071.pdf
    • https://cdn.shopify.com/s/files/1/0433/5969/9109/files/vovibemijenudep.pdf
    • https://cdn.shopify.com/s/files/1/0432/7620/6238/files/wutuxeluwe.pdf
    • https://cdn.shopify.com/s/files/1/0437/6389/2375/files/paradigma_behavioristik.pdf
    • https://cdn.shopify.com/s/files/1/0433/2129/5003/files/toshiba_protable_dvd_player.pdf
    • https://cdn.shopify.com/s/files/1/0431/8268/6370/files/81833826469.pdf
    • https://cdn.shopify.com/s/files/1/0434/2710/2887/files/a_practical_english_grammar_3rd_edition.pdf
    • https://cdn.shopify.com/s/files/1/0432/7643/5621/files/13795146090.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000666f.bin
1f17ee180e6afabc955d9b35e6b01693d6635dcfe87c9c27c25089a35223de14
pdf-font-stream PDF embedded font (sfnt) at offset 0x666F 5136 bytes
font_01_sfnt_off000077c4.bin
dc832f199529c9409860339da28dc9ba6e1d07a88fcc57520f4ed75d74c917a4
pdf-font-stream PDF embedded font (sfnt) at offset 0x77C4 9668 bytes
font_02_sfnt_off000098c9.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0x98C9 4324 bytes