Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0b53dcb8388142b…

MALICIOUS

PDF

56.5 KB Created: 2020-08-11 08:43:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 981d51933652b94e31f9eeb10bbd0414 SHA-1: 3cb5c4cfca0632e9feb001013835f9e9cb4ce0af SHA-256: d0b53dcb8388142b8d26ef6e1ce2bd088d0a5097a5d5f44ef934a136ec316538
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to ttraff.ru. Additionally, it exhibits a PDF link farm heuristic, with numerous links pointing to Shopify domains, likely for SEO poisoning. The document body contains a call-to-action phrase, suggesting a lure to click the embedded malicious link, which is designed to redirect the user to malicious infrastructure.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=gujarat+samachar+epaper+bhavnagar+pdf+download
    • http://files.fitnesszonesteinbach.com/uploads/1/3/0/7/130775647/5305069.pdf
    • http://files.koshek.net.ua/uploads/1/3/1/6/131606003/378354f.pdf
    • http://files.serenaremy.com/uploads/1/3/0/8/130814676/7892436.pdf
    • https://cdn.shopify.com/s/files/1/0434/8579/0358/files/powakimowixukamuwuw.pdf
    • https://cdn.shopify.com/s/files/1/0432/2282/7165/files/xeramawewiwerawipotox.pdf
    • https://cdn.shopify.com/s/files/1/0451/9713/1925/files/check_font_size_in.pdf
    • https://cdn.shopify.com/s/files/1/0435/4949/1359/files/college_mathematics_clep_practice_test.pdf
    • https://cdn.shopify.com/s/files/1/0434/7274/8710/files/warhammer_40k_tyranids_8th_codex.pdf
    • https://cdn.shopify.com/s/files/1/0431/2757/0596/files/puzolevubesiwemeb.pdf
    • https://cdn.shopify.com/s/files/1/0428/4638/8380/files/19455163592.pdf
    • https://cdn.shopify.com/s/files/1/0430/2766/0951/files/57537292249.pdf
    • https://cdn.shopify.com/s/files/1/0429/6923/5619/files/cpec_and_gilgit_baltistan.pdf
    • https://cdn.shopify.com/s/files/1/0433/4223/3755/files/aquiles_nazoa_poemas.pdf
    • https://cdn.shopify.com/s/files/1/0431/8245/7000/files/29603399385.pdf
    • https://cdn.shopify.com/s/files/1/0431/1970/6273/files/bhagavad_gita_chapter_7.pdf
    • https://cdn.shopify.com/s/files/1/0437/6880/7578/files/lizita.pdf
    • https://cdn.shopify.com/s/files/1/0440/2737/9877/files/alleluia_alleluia_hymn_to_joy.pdf
    • https://cdn.shopify.com/s/files/1/0429/6517/2387/files/kegotusijibupureni.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000760d.bin
15ec1aca4e0d449098ae1c21d5a421126e620a453086765911e085fe2a8773d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x760D 5968 bytes
font_01_sfnt_off00008a55.bin
95cf6dc33159b9f200ffa3a61cd53ad1084e0d6f43ea3cc193aa51a0d23b52da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A55 8328 bytes
font_02_sfnt_off0000a4fc.bin
5245ef5ba84d1bc2e1a2e06cace2668d1122e92610f68da5a144e2c9a1d6ec2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4FC 15320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.