Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd16fced0045c58f…

MALICIOUS

PDF

432.3 KB Created: 2020-09-01 00:58:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b5a6904ce0e3965d1364ef1fbde6fd2 SHA-1: 1b5010a1ff3ae934b9e32fc875d8ce6f5ae84fc5 SHA-256: bd16fced0045c58fdf0837a5ac913fd29e3a69b9c02442e55fd57f56c77c216c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The embedded URL, https://ttraff.ru/pify?keyword=abida+khanam+naat+video, is identified as malicious. The document body, though heavily obfuscated, appears to contain the same URL, suggesting a phishing or redirection attempt.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=abida+khanam+naat+video
    • https://cdn.shopify.com/s/files/1/0432/0254/3778/files/exercices_francais_adjectifs_possessifs.pdf
    • https://cdn.shopify.com/s/files/1/0430/7304/4647/files/business_credit_report_definition.pdf
    • https://cdn.shopify.com/s/files/1/0433/9826/7029/files/19725198166.pdf
    • https://cdn.shopify.com/s/files/1/0432/2865/9874/files/7983637433.pdf
    • https://cdn.shopify.com/s/files/1/0428/1614/3526/files/acidosis_metabolica_anion_gap_normal.pdf
    • https://cdn.shopify.com/s/files/1/0438/5020/3296/files/wuvagepofiw.pdf
    • https://cdn.shopify.com/s/files/1/0437/1539/5738/files/daily_behavior_and_homework_sheet.pdf
    • https://static.usrfiles.com/ugd/3826db_0c52a3c25818450dbda5244b7e2b6ea7.pdf
    • https://static.usrfiles.com/ugd/ca300b_70d2885a82074b20aa37f97a272668b1.pdf
    • https://static.usrfiles.com/ugd/6f9b04_9d7e45436d804bbe9ec64b95d8cb387b.pdf
    • https://static.usrfiles.com/ugd/822ecd_1e1f4138a7d745c8819bc3c80bb80152.pdf
    • https://static.usrfiles.com/ugd/ff2e72_66d0e07837e9407cb2db9f0936ef8a37.pdf
    • https://static.usrfiles.com/ugd/72b0e7_0c477e928294484093a4c6b85f33834b.pdf
    • https://static.usrfiles.com/ugd/d902bb_1bc0f4320e544b08a29788a29460a479.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00065e69.bin
80a8972e0f541b7d6b521b24fc8e8581e912e6308f5fce9c65ad40324abfc782		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65E69 5012 bytes
font_01_sfnt_off00066f56.bin
bc0d4333519b653ed467b3208ec453367ab6e4cb375fdfbe298aefa085c6b4c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66F56 15040 bytes
font_02_sfnt_off00069e0b.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69E0B 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.