Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdd173c9a479ba3f…

MALICIOUS

PDF

55.5 KB Created: 2020-08-23 11:15:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63a41aefd0e2907449acbbd91f23f5ce SHA-1: 4a3d4f90eee9339892820b3c0ebb11cde7c8ff2e SHA-256: bdd173c9a479ba3f39e71e07a812e6f07ab472ed2e9958bcf8473a9cdece8c40
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, many pointing to Shopify domains, but one critical link directs to a known malicious redirector at 'ttraff.ru'. This suggests a link farm or redirection tactic to obscure the final malicious destination. The document body, though heavily corrupted, contains fragments of the URL and keywords like 'flight simulator x android 1', indicating a potential lure. No scripts were extracted, and the primary malicious activity appears to be the redirection via embedded links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=flight+simulator+x+android+1
    • http://files.ellenjohnsonmosley.com/uploads/1/3/2/6/132695517/887644f1.pdf
    • https://cdn.shopify.com/s/files/1/0433/2666/8952/files/xijuzepalojibu.pdf
    • https://cdn.shopify.com/s/files/1/0431/1983/7333/files/vatozonotenemufisi.pdf
    • https://cdn.shopify.com/s/files/1/0431/6335/3250/files/32387581135.pdf
    • https://cdn.shopify.com/s/files/1/0432/3796/5979/files/javojabakunavidop.pdf
    • https://cdn.shopify.com/s/files/1/0440/6679/9766/files/4785961066.pdf
    • https://cdn.shopify.com/s/files/1/0436/5484/0485/files/quintessence_international_journal_authors_guidelines.pdf
    • https://cdn.shopify.com/s/files/1/0437/6444/9437/files/9946760980.pdf
    • https://cdn.shopify.com/s/files/1/0462/4708/4181/files/ligajavifaxu.pdf
    • https://cdn.shopify.com/s/files/1/0431/4162/8072/files/nupesosus.pdf
    • https://cdn.shopify.com/s/files/1/0433/5868/3294/files/antiviral_drugs_list.pdf
    • https://cdn.shopify.com/s/files/1/0430/6924/3553/files/72153587535.pdf
    • https://cdn.shopify.com/s/files/1/0433/8778/1276/files/intermediate_christmas_piano_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c25.bin
06f17a965382b4cd146ff09831cc26fdcf4867274ebe4040fa9803f5ad6542f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C25 8696 bytes
font_01_sfnt_off0000793d.bin
101930f787d629945ef7237e43abe5a648cbf3922470849afcce89bcd862750a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x793D 5080 bytes
font_02_sfnt_off00008a58.bin
807fc92cb83e098e25b61a3c957bfaf9dda77947406415675a3cbaad4ddab8ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A58 10260 bytes
font_03_sfnt_off0000adb3.bin
c79b30b6bd44b50f109e51717429520d8311dc1dd7d649b6a46b8818e03a33a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xADB3 16060 bytes
font_04_sfnt_off0000c244.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC244 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.