Malicious PDF — malware analysis report

Static analysis result for SHA-256 bffd2b5688c968f0…

MALICIOUS

PDF

40.0 KB Created: 2020-08-24 23:15:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cee19e4abac8f6869a641be404e3180 SHA-1: b21fb92fb1ee875238a1ce13cca13374dd9064b3 SHA-256: bffd2b5688c968f0fac0f15f7a4b988fd617329acdbfd889e34b9d8b42bd8313
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.ru'. The document body, though heavily obfuscated, contains text that appears to be a lure for an 'agronomy guide'. This link is likely intended to redirect users to a malicious site or download further malware. The file also contains a PDF link farm heuristic, indicating a large number of external links, many of which are hosted on Shopify, but the primary malicious link is the redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=agronomy+guide+for+field+crops+pdf
    • http://files.daradrar.com/uploads/1/3/1/3/131379246/6311640c6f30.pdf
    • https://cdn.shopify.com/s/files/1/0435/8632/2600/files/lutaforofom.pdf
    • https://cdn.shopify.com/s/files/1/0435/5650/3707/files/avengers_age_of_ultron_movie_filmywap.pdf
    • https://cdn.shopify.com/s/files/1/0431/1577/4108/files/54865517218.pdf
    • https://cdn.shopify.com/s/files/1/0434/6213/1869/files/materi_akuntansi_dasar_1.pdf
    • https://cdn.shopify.com/s/files/1/0431/8222/7617/files/21469419612.pdf
    • https://cdn.shopify.com/s/files/1/0462/4846/0439/files/xizegovitojirelexuvafo.pdf
    • https://cdn.shopify.com/s/files/1/0434/0118/3397/files/financial_reporting_analyst_careers.pdf
    • https://cdn.shopify.com/s/files/1/0432/2633/3351/files/javutibekib.pdf
    • https://cdn.shopify.com/s/files/1/0437/3066/5637/files/luzagowarononowoba.pdf
    • https://cdn.shopify.com/s/files/1/0435/5915/7921/files/tabla_alcoholomania.pdf
    • https://cdn.shopify.com/s/files/1/0434/2281/0263/files/tenamesajorifiwure.pdf
    • https://cdn.shopify.com/s/files/1/0438/3404/8669/files/wuthering_heights_test_questions_and_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058d9.bin
24314d0a2bf2eca728e9c492fbf1c4716221dabb55fcf1404be3d249ac01f571		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58D9 5356 bytes
font_01_sfnt_off00006b02.bin
bb3a22c592a5e27aacee760d6145c52981aef53fc2836490c2dfe75c8b84b776		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B02 12804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.