Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2ba6d243af1d752…

MALICIOUS

PDF

85.4 KB Created: 2020-08-31 02:59:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 356d8cc1dc12396d1d69d36ccdc3072a SHA-1: edaf36f3303ccac6c88a042cb454131d14388916 SHA-256: c2ba6d243af1d75257e10749a3581366454478dffeec7907b74ceca8afb39e39
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure related to a 'motivation letter for job in embassy' and includes a link to 'ttraff.ru', which is flagged as a malicious redirector. The document also exhibits characteristics of a PDF SEO link farm, with numerous links pointing to external PDFs, many hosted on cdn.shopify.com. The primary attack vector appears to be social engineering, tricking the user into clicking the malicious link under the guise of a job application document.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=motivation+letter+for+job+in+embassy
    • https://static.usrfiles.com/ugd/b8c837_0bac334638874eb7886b943bbae14768.pdf
    • https://static.usrfiles.com/ugd/405339_6e3b5ba8691b42c5936b27e8f31c8d33.pdf
    • https://static.usrfiles.com/ugd/b8c837_b5458e4420894b33a049d23c8473a727.pdf
    • https://static.usrfiles.com/ugd/98e298_720b414dabb740e69369b7222b7b4617.pdf
    • https://cdn.shopify.com/s/files/1/0434/8831/3506/files/xagadidugunag.pdf
    • https://cdn.shopify.com/s/files/1/0431/0722/1661/files/rival_roaster_oven.pdf
    • https://cdn.shopify.com/s/files/1/0438/0976/7584/files/gujomojavuxuviwasim.pdf
    • https://cdn.shopify.com/s/files/1/0433/7808/1955/files/bharat_movie_4k_hd_video_song.pdf
    • https://cdn.shopify.com/s/files/1/0433/9479/3630/files/lijasisibobixux.pdf
    • https://cdn.shopify.com/s/files/1/0428/7689/5398/files/mis_essentials_4th_edition_free.pdf
    • https://cdn.shopify.com/s/files/1/0437/1283/9834/files/93432482079.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/kepikopu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc91.bin
dd7b880f1c6958317b71933e3175eb4154b1281d355b69180e4ce829e506ee21
pdf-font-stream PDF embedded font (sfnt) at offset 0xFC91 2828 bytes
font_01_sfnt_off0001068b.bin
45659075855a23847ce790cbfc27834b0980be43f36a10a6273640b7ad91b7db
pdf-font-stream PDF embedded font (sfnt) at offset 0x1068B 5084 bytes
font_02_sfnt_off000117c2.bin
74c684c23bf43bc7e23a08ddd83e1d5da26beff655a631fb6b96a96f304ecd30
pdf-font-stream PDF embedded font (sfnt) at offset 0x117C2 10036 bytes
font_03_sfnt_off00013a02.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3
pdf-font-stream PDF embedded font (sfnt) at offset 0x13A02 4324 bytes