Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdbe6a404386f171…

MALICIOUS

PDF

33.8 KB Created: 2020-08-28 20:42:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8cf0b759ac8d044772e6b258e597d799 SHA-1: 48957bc6d8ba12d80ec1ef0813bda7bb183e671e SHA-256: bdbe6a404386f17163e1b18584db624f9a87e09a99e650de1112f3927d2b7286
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a link farm designed to appear as search results for a movie, with the primary malicious link being https://ttraff.ru/wix?keyword=amarte+duele+pelicula+completa+desca. This URL is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and other benign-looking PDF links, suggesting a lure to drive traffic to the malicious redirector. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=amarte+duele+pelicula+completa+desca
    • https://static.usrfiles.com/ugd/b8c837_c6158310df2f4a8096c6c1d960caf0ed.pdf
    • https://static.usrfiles.com/ugd/b8c837_a96e8acb28fd41e1b6dbd50369af9295.pdf
    • https://static.usrfiles.com/ugd/b8c837_e4b728b8f34e4bc4b63c6ee87bb3e84a.pdf
    • https://static.usrfiles.com/ugd/b8c837_6d9ff9cda2bc4181aee707072540467a.pdf
    • https://cdn.shopify.com/s/files/1/0439/6387/5486/files/mibojudofamidopanenav.pdf
    • https://cdn.shopify.com/s/files/1/0440/9815/8744/files/8762874541.pdf
    • https://cdn.shopify.com/s/files/1/0433/8493/0462/files/naruto_blazing_mod_apk_2._2_2.pdf
    • https://cdn.shopify.com/s/files/1/0431/6296/0021/files/56842591983.pdf
    • https://cdn.shopify.com/s/files/1/0434/8765/8141/files/manovabu.pdf
    • https://cdn.shopify.com/s/files/1/0447/0882/3193/files/iphigenia_in_tauris_goethe.pdf
    • https://cdn.shopify.com/s/files/1/0433/6130/4727/files/ccie_data_center_v2_workbook.pdf
    • https://cdn.shopify.com/s/files/1/0458/0799/2998/files/wifudaremidelujebakemovax.pdf
    • https://static.usrfiles.com/ugd/b8c837_1f09e834ede14f4287359d0c1aa2bbd8.pdf
    • https://static.usrfiles.com/ugd/b8c837_1c88fd91eb284196bf4a88e69f2587c6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000463e.bin
8fb5a5325899e61eb8391c526f1f474d4f87a2467883de9cd9dddd7ad7cca346		 pdf-font-stream PDF embedded font (sfnt) at offset 0x463E 5208 bytes
font_01_sfnt_off000057cc.bin
40c711674a4af8b03e0ee7ecd7d645e39fa4da8055c7fe6d54ac1824de9c5c5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57CC 10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.