Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6273843cdf8cbc6…

MALICIOUS

PDF

40.8 KB Created: 2020-08-31 03:57:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 43eabc9cbae03aa08c601b9a8855d2d0 SHA-1: e37468a0d21a3ca546a814f8e69578c2e95ea844 SHA-256: c6273843cdf8cbc682a19150e3dd4b7d844c29b57edeccbc0c6266d5bc45c02e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded links, with one identified as a malicious redirector. The document body, though partially garbled, includes the URL 'https://ttraff.ru/wix?keyword=mosin+nagant+bolt+disassembly', which is flagged as malicious. The presence of a link farm heuristic further suggests an attempt to distribute malicious content. The file was generated by wkhtmltopdf, indicating it might be part of a larger automated process.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=mosin+nagant+bolt+disassembly
    • https://static.usrfiles.com/ugd/5b9a87_caed54a0995d49549aa8ef4ad6c3d605.pdf
    • https://static.usrfiles.com/ugd/b8c837_af21451e064f48b89af1c0f3b21936c3.pdf
    • https://static.usrfiles.com/ugd/8d57bd_3e83bcde582645e0ab16a2a3aba46218.pdf
    • https://cdn.shopify.com/s/files/1/0438/9653/7243/files/square_root_java.pdf
    • https://cdn.shopify.com/s/files/1/0461/9704/7447/files/98935288385.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_ea7b51f3c276420db3d80085578518c5.pdf
    • https://static.usrfiles.com/ugd/b8c837_caba378897434a4e9a4c7be3dabc2fbf.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/92283418618.pdf
    • https://cdn.shopify.com/s/files/1/0430/4273/4237/files/19973916280.pdf
    • https://cdn.shopify.com/s/files/1/0427/8393/2582/files/biology_past_questions_and_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000643f.bin
856d71cad1bae034924be416a5636b4315d526c82b8713046873007cd8a8d8d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x643F 5296 bytes
font_01_sfnt_off0000763a.bin
ca5b96355ec9bc4a4bb2064a6ff3140ce604a2221e9b92dc921f7bc646f20cb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x763A 9524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.