Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2dfc31f88aaa9b0…

MALICIOUS

PDF

43.9 KB Created: 2020-08-10 22:46:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50ef77d4390037502e0be2cca946a15b SHA-1: 96fbbf6da904aab0140af1e2be29772286aa729e SHA-256: c2dfc31f88aaa9b03e1322e3945a9e5bbf3653f25dd5c0e4a804c9d9650e39ad
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on Shopify. One of the primary links, https://ttraff.ru/pify?keyword=boy+name+list+hindu+latest+2020+pdf, is identified as a malicious redirector. The document body, though heavily obfuscated, contains references to this malicious URL, suggesting the intent is to redirect users to malicious content. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=boy+name+list+hindu+latest+2020+pdf
    • http://files.mikaylamac.com/uploads/1/3/0/7/130739648/goserojofitara_zegoja_xuvekikikepu.pdf
    • http://files.thebrainyblonde.com/uploads/1/3/2/6/132681308/966571.pdf
    • http://files.amitybrusharborchurch.com/uploads/1/3/0/8/130874360/wumemo.pdf
    • http://files.pamelabramble.com/uploads/1/3/1/4/131406960/e3b781ae75fa.pdf
    • https://cdn.shopify.com/s/files/1/0428/3459/1907/files/31548137900.pdf
    • https://cdn.shopify.com/s/files/1/0428/0451/0887/files/rakibuvixozurosino.pdf
    • https://cdn.shopify.com/s/files/1/0431/6856/3355/files/pdf_akuntansi_perbankan.pdf
    • https://cdn.shopify.com/s/files/1/0430/5489/1161/files/wreck_it_ralph_sex.pdf
    • https://cdn.shopify.com/s/files/1/0429/2208/2460/files/35594764753.pdf
    • https://cdn.shopify.com/s/files/1/0436/4029/1486/files/r_kelly_tp2_zip.pdf
    • https://cdn.shopify.com/s/files/1/0431/5670/1348/files/50296171100.pdf
    • https://cdn.shopify.com/s/files/1/0435/5109/6981/files/nigakesorapujulibuzojival.pdf
    • https://cdn.shopify.com/s/files/1/0433/2191/7598/files/50959147060.pdf
    • https://cdn.shopify.com/s/files/1/0436/3816/1561/files/physiologie_tube_digestif.pdf
    • https://cdn.shopify.com/s/files/1/0435/8481/5263/files/casio_projector_xj_v2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cfd.bin
25bd1ce4df46577e11907d39d9b72c9fc403890a0212d37bd0c4500f5fb60fb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CFD 5608 bytes
font_01_sfnt_off00007ff5.bin
5fd7f4833cbed9b2bc92b0be2b21aac29d8a60c66b12c21e699900de97b16e3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FF5 10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.