Malicious PDF — malware analysis report

Static analysis result for SHA-256 b34060a1999d541e…

MALICIOUS

PDF

41.1 KB Created: 2020-09-01 04:48:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d462f1de18597fae942a796d8ccdf48 SHA-1: 1c6360a54f5f8e5a69665755af51af1ca7fe89be SHA-256: b34060a1999d541e487918d5ad28d8b269b0a06112b8e5e4e8b126f862e60c90
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1200 Hardware Addends

The PDF file contains a large number of embedded links, identified as a link farm, directing users to various external resources. One of these links, https://ttraff.ru/wix?keyword=phylum+arthropoda+characteristics+pdf, is flagged as a known malicious redirector. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create SEO-optimized content for link farms.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=phylum+arthropoda+characteristics+pdf
    • https://cdn.shopify.com/s/files/1/0435/0646/6975/files/past_simple_affirmative_and_negative.pdf
    • https://cdn.shopify.com/s/files/1/0429/5753/7439/files/contaminacion_atmosferica_libro.pdf
    • https://cdn.shopify.com/s/files/1/0431/8055/6452/files/56943218329.pdf
    • https://cdn.shopify.com/s/files/1/0430/3549/2503/files/61867032839.pdf
    • https://cdn.shopify.com/s/files/1/0457/5831/6700/files/biharmasti_in_dj_2018_bhojpuri.pdf
    • https://static.usrfiles.com/ugd/b8c837_bab4d15178854856b34967788fab7236.pdf
    • https://static.usrfiles.com/ugd/8a419d_24fd0cb488184cf0b2a3f8786c773397.pdf
    • https://static.usrfiles.com/ugd/dd4472_3c8f18052ca049959d925d73639d3f50.pdf
    • https://static.usrfiles.com/ugd/ace02d_ff4edbe3cbe644d4b3605077b650b572.pdf
    • https://cdn.shopify.com/s/files/1/0449/8066/6526/files/best_kits_in_fifa_15.pdf
    • https://cdn.shopify.com/s/files/1/0432/0660/7012/files/dafevox.pdf
    • https://cdn.shopify.com/s/files/1/0438/3621/1362/files/vorovolalitonumofupo.pdf
    • https://cdn.shopify.com/s/files/1/0434/8264/4642/files/74704619584.pdf
    • https://cdn.shopify.com/s/files/1/0431/6823/5675/files/94468277425.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000628b.bin
2dc60d459cbe5fc1de85816253c5e09c2fdafe854b045d09683155803db7e33e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x628B 5496 bytes
font_01_sfnt_off00007518.bin
3a76041a3976a35cc8dab73706d47e0f0a6bf9f95f48814b030d6dcc98faf774		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7518 10132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.