Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9c55b39e5658980…

MALICIOUS

PDF

60.1 KB Created: 2020-08-08 17:28:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5dc3c1154367db0b6dc740d7d254bfcf SHA-1: 2026d1ee9aa1864e976c6b90570042298c348fb2 SHA-256: c9c55b39e565898051f68528458b0b10c1cab28e7a2a0533cfdb99de4e0bf039
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=african+union+anthem+lyrics+pdf'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, many hosted on Shopify. The document body, though heavily obfuscated, contains references to these URLs, suggesting an attempt to disguise malicious content as legitimate documents. The primary intent appears to be redirecting users to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=african+union+anthem+lyrics+pdf
    • http://files.gaindetalks.com/uploads/1/3/0/8/130874629/dojoja-kefuzegomoli-wadab.pdf
    • http://files.lifetimecenter.com/uploads/1/3/0/8/130813851/38a09fe2b.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nudukesobiji.pdf
    • https://cdn.shopify.com/s/files/1/0430/2117/2897/files/66709168616.pdf
    • https://cdn.shopify.com/s/files/1/0437/4629/5959/files/p90x3_mass_schedule.pdf
    • http://files.tpak.people.ua.edu/uploads/1/3/1/8/131857479/setokemiwulaxuture.pdf
    • https://cdn.shopify.com/s/files/1/0435/6741/5457/files/92823965401.pdf
    • https://cdn.shopify.com/s/files/1/0431/8812/5857/files/sibimumuwelizuzukibive.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/ganisififado.pdf
    • https://cdn.shopify.com/s/files/1/0435/1311/8872/files/80945563718.pdf
    • https://cdn.shopify.com/s/files/1/0431/8307/9592/files/11900376260.pdf
    • https://cdn.shopify.com/s/files/1/0437/6484/2647/files/positive_and_negative_effects_of_economic_globalization.pdf
    • https://cdn.shopify.com/s/files/1/0431/4356/1384/files/daxeguzolosefoviwugenomim.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000a891.bin
179fa0d0c4c507ad27bf9e5ee5124e40cb383d600460c9240c1c9be246d2c9be		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA891 24828 bytes
font_00_sfnt_off00006831.bin
1f704321da6c9533394e3daca62f4c9b2d8e087e2f11655debdc550516026f40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6831 3012 bytes
font_01_sfnt_off000072f9.bin
bef3cb1579b8914635a8995be334a477e009dd8bcd4de6faf04dbb513e0031a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72F9 5368 bytes
font_02_sfnt_off00008508.bin
5347d3024ed544464580857b7043dfb06e1ab7afa75fd9d2ce48685b241aed88		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8508 10324 bytes
font_04_sfnt_off0000d4a7.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD4A7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.