Malicious PDF — malware analysis report

Static analysis result for SHA-256 daa437f26edf4e3d…

MALICIOUS

PDF

40.7 KB Created: 2020-08-29 06:04:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4262a3cf579a940b2e353f03c80e7f31 SHA-1: 5a2c43750dc879e79814ed90732dba53ffe88603 SHA-256: daa437f26edf4e3d9b42d08a442ab047641a816cdbdc977a42a22bc128d34b31
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to its structure, which includes a large number of external links. One critical heuristic firing indicates a PDF link to known malicious redirector infrastructure, specifically 'https://ttraff.ru/wix?keyword=fitflops+size+8'. Another heuristic identified a PDF link farm, suggesting an attempt to manipulate search engine results or distribute content widely. The document body contains garbled text, but the presence of the malicious URL is the primary indicator of compromise.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=fitflops+size+8
    • https://static.usrfiles.com/ugd/b8c837_fd8ad63ecae84ffc85b9a3f23ffe319e.pdf
    • https://static.usrfiles.com/ugd/b8c837_5efe5833b3c54858ac7df3b96a4a7ffc.pdf
    • https://static.usrfiles.com/ugd/b8c837_941cb09722124005a9a745a8750c1b6b.pdf
    • https://static.usrfiles.com/ugd/b8c837_675826b6c0e14a5c887689b8dad0a5f5.pdf
    • https://cdn.shopify.com/s/files/1/0443/9402/1030/files/methods_of_information_geometry_amari.pdf
    • https://cdn.shopify.com/s/files/1/0429/8031/1203/files/demography_books_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0465/0074/1272/files/72713170275.pdf
    • https://cdn.shopify.com/s/files/1/0439/2484/8795/files/benim_hocam_ayt_matematik_soru_bankas.pdf
    • https://cdn.shopify.com/s/files/1/0447/5482/9463/files/best_breathable_sheets.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/tipibag.pdf
    • https://cdn.shopify.com/s/files/1/0433/0556/6366/files/english_story_book_free_download.pdf
    • https://cdn.shopify.com/s/files/1/0447/8051/9590/files/39958264426.pdf
    • https://static.usrfiles.com/ugd/b8c837_be0534bbc0234e57ba9464a9c57a1341.pdf
    • https://static.usrfiles.com/ugd/b8c837_1d561bd7e3df411cb018252ae87adcdf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a8a.bin
16d33e947e8d27b9a9b00e35cdf5e5ea9879ced88f4881ac742628c001cc8be6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A8A 4788 bytes
font_01_sfnt_off00006af8.bin
cae9880977707ea77dbc16a006e028f694afa79ef2e1b440cd8cbf480ae265e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AF8 13692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.