Malicious PDF — malware analysis report

Static analysis result for SHA-256 b384cf27f4d52798…

MALICIOUS

PDF

174.9 KB Created: 2020-08-01 18:11:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68dbc78ae08cd943e40cd76d0e35e2b6 SHA-1: fb2c95e2a1384d26620784223cdcc7ad222c5391 SHA-256: b384cf27f4d52798314735d651386d2f9843075e5ac980ce8ee8a06658e192fb
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/pify?keyword=introduction+to+environmental+engineering+solution+manual+pdf'. This URL is presented within the document body, suggesting a social engineering attempt to trick the user into visiting a malicious site by posing as a desirable document. No scripts were extracted from this sample.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=introduction+to+environmental+engineering+solution+manual+pdf
    • http://files.goldenorchidphotography.org/uploads/1/3/1/3/131398406/6398309.pdf
    • http://files.iam720.org/uploads/1/3/2/6/132695517/lerisinerudut-fajedemoregepo.pdf
    • http://files.noorduynmathhelp.com/uploads/1/3/1/3/131383760/logukerar.pdf
    • https://cdn.shopify.com/s/files/1/0432/5454/6590/files/30990280281.pdf
    • https://cdn.shopify.com/s/files/1/0433/4085/7494/files/41604417814.pdf
    • https://cdn.shopify.com/s/files/1/0436/9504/6824/files/marujiwa.pdf
    • https://cdn.shopify.com/s/files/1/0431/0158/5570/files/69901648631.pdf
    • https://cdn.shopify.com/s/files/1/0431/8858/4605/files/marvel_schebler_carburetor_manual.pdf
    • https://cdn.shopify.com/s/files/1/0429/7061/1861/files/78120273616.pdf
    • https://cdn.shopify.com/s/files/1/0429/8201/5129/files/46091161497.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/1317992411.pdf
    • https://cdn.shopify.com/s/files/1/0430/8339/9329/files/rimogijamazuvis.pdf
    • https://cdn.shopify.com/s/files/1/0439/3225/4376/files/95999639572.pdf
    • https://cdn.shopify.com/s/files/1/0437/0061/7381/files/31768676659.pdf
    • https://cdn.shopify.com/s/files/1/0433/2974/9145/files/skyrim_legendary_edition_strategy_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00023b3e.bin
1ebaa7431d3a11ead4f850953aa1774b418e4c1dcc8dbc85ff1d8a2da60e4fb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23B3E 5472 bytes
font_01_sfnt_off00024dc5.bin
2c1b3b3fcf11d10f5f842214be9f6cfea64f7ae940b96421e2de868dd2455d41		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24DC5 2848 bytes
font_02_sfnt_off00025919.bin
38fb3d432f98081e68b6f4d443b7403d815a666e18cb58e892c890b24fec0873		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25919 19204 bytes
font_03_sfnt_off0002952b.bin
99a52bf8ea423efe858852b03def4f3e92c8bdc3bd7f60dab7122454dfb0d886		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2952B 16652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.