Malicious PDF — malware analysis report

Static analysis result for SHA-256 baaf0b5042653da1…

MALICIOUS

PDF

82.5 KB Created: 2020-08-30 09:04:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a5ab46fb7f39a58beb129569a39f556 SHA-1: 1f81c355a3763a072b0087512120cab55182e6c3 SHA-256: baaf0b5042653da1fbb84b3a018bf279b8ecf2be5fd5117d64eb5db17c95c237
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.ru, which is likely intended to lead the user to a malicious site. The document body, though heavily obfuscated, contains the same URL, suggesting it's the primary lure. The presence of a link farm heuristic further indicates a malicious intent to distribute links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=nashville+things+to+do+in+june
    • https://static.usrfiles.com/ugd/e3834b_bde54e325812431fbd8fe9693019adaa.pdf
    • https://static.usrfiles.com/ugd/05900a_6dc99c9b8d334b979ea4979156f5e6c5.pdf
    • https://static.usrfiles.com/ugd/fd7405_051ad8b90f0245d8b800b482c7b14aca.pdf
    • https://static.usrfiles.com/ugd/b8c837_9b89e0df680240afac0dccc363cee84e.pdf
    • https://static.usrfiles.com/ugd/b13fd1_37fd25db81594a36a584f2f73cef272d.pdf
    • https://cdn.shopify.com/s/files/1/0428/7663/3247/files/english_grammar_vocabulary_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0430/2720/2205/files/20919079897.pdf
    • https://cdn.shopify.com/s/files/1/0439/0954/6136/files/telunanipu.pdf
    • https://cdn.shopify.com/s/files/1/0427/7462/6470/files/58395162293.pdf
    • https://cdn.shopify.com/s/files/1/0431/3517/2770/files/the_challenge_of_democracy_13th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0433/8070/3382/files/51058234605.pdf
    • https://cdn.shopify.com/s/files/1/0431/5725/8395/files/blockchain_revolution.pdf
    • https://cdn.shopify.com/s/files/1/0431/9802/1793/files/mavomugebexumutugu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f84e.bin
8bb4cb30ea8c7d596a11b512e2976f695e3bb324d07526318575db4a47389739		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF84E 5096 bytes
font_01_sfnt_off000109ac.bin
a6ef5085c48db917e992e65bd72f2ab8f6c7c38c140d91b07e5ca60cc180e89d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109AC 16644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.