Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae6bb70982411508…

MALICIOUS

PDF

48.7 KB Created: 2020-08-12 15:26:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 619382bd1e32c44e62b082168d3101a4 SHA-1: 3815d35ec02e753764ec9d94b94cb49ce73f07e4 SHA-256: ae6bb70982411508c7ac61d94928c97d871fd5ddf9c095cdad88872aeea09a5b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1200 Hardware Add-in T1059.001 PowerShell

The PDF contains a link farm designed to manipulate search engine results, directing users to a malicious redirector. The primary malicious URL is 'https://ttraff.ru/pify?keyword=elnathan+john+becoming+nigerian+pdf+download', which is flagged as a malicious redirector. The document body text, though heavily obfuscated, contains references to the malicious URL and other benign-looking Shopify links, suggesting a lure for downloading potentially malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=elnathan+john+becoming+nigerian+pdf+download
    • http://files.westvalleyfamilies.com/uploads/1/3/0/8/130813834/pitepegixusedanug.pdf
    • http://files.standrews801.com/uploads/1/3/0/7/130739779/fexalirezi.pdf
    • http://files.bestinmidwest.com/uploads/1/3/1/4/131453283/samalozape_remowazaxotej.pdf
    • http://zegutejaz.sally-parker.com/uploads/1/3/1/3/131380429/xukagoged_fijob.pdf
    • https://cdn.shopify.com/s/files/1/0431/8960/0414/files/66225624130.pdf
    • https://cdn.shopify.com/s/files/1/0434/5095/7991/files/72822760677.pdf
    • https://cdn.shopify.com/s/files/1/0433/4164/3928/files/katefimaxu.pdf
    • https://cdn.shopify.com/s/files/1/0431/6643/3429/files/19691636334.pdf
    • https://cdn.shopify.com/s/files/1/0437/7686/8504/files/vivakofexonapemalukepav.pdf
    • https://cdn.shopify.com/s/files/1/0427/8226/1415/files/95249335938.pdf
    • https://cdn.shopify.com/s/files/1/0437/8099/7269/files/45013533243.pdf
    • https://cdn.shopify.com/s/files/1/0430/4578/1665/files/gewifitezok.pdf
    • https://cdn.shopify.com/s/files/1/0431/8547/1656/files/94160778263.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/98908457197.pdf
    • https://cdn.shopify.com/s/files/1/0434/5207/2088/files/feminuwuwipavaxikimi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006847.bin
2dcb7aeef577694f559fcf73a6c17f39fcc347676f17c6a21b6071e3cd561f16		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6847 5656 bytes
font_01_sfnt_off00007b65.bin
eb9133d6ff9cd3064caf35e9de0b028c282e7ed0efc9ff25e215848c0d32ac1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B65 10496 bytes
font_02_sfnt_off00009f33.bin
e996d7728a4c3280414fb0b087adbec8e883e1f2e454e604528eb600bf1cf7d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F33 16452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.