Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbdf978ceaf0cd0d…

MALICIOUS

PDF

38.2 KB Created: 2020-07-29 04:42:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 88638172f2152fb41ce5275a0bfa4cf6 SHA-1: 600a28a9774cfadc32a3e592a0085ab803278361 SHA-256: dbdf978ceaf0cd0d4e59da5e7fe298e0fa090f3a36301ae9094ef636f4b0ad92
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, with one heuristic specifically identifying it as a PDF link farm. The primary redirector URL, 'https://ttraff.ru/pify?keyword=bubble+sheet+sample+pdf', is flagged as malicious. This suggests the document's purpose is to lure users to malicious sites, likely for phishing or to download further malware. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=bubble+sheet+sample+pdf
    • http://files.millerstaxidermy.net/uploads/1/3/0/8/130874489/mixosu.pdf
    • http://files.fatherandsonfun.com/uploads/1/3/2/6/132680986/6707939.pdf
    • http://files.fuserealtyhomes.ca/uploads/1/3/0/8/130874582/756032.pdf
    • http://files.segamatbikers.com/uploads/1/3/0/9/130969254/3f255dbd5de4fd.pdf
    • http://files.tfdonaldson.com/uploads/1/3/2/6/132695714/wubulo_wuzegumewu_gabexesulegi.pdf
    • http://files.tfdona
    • https://cdn.shopify.com/s/files/1/0429/8833/9361/files/76406384958.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pejolezogumulugadajo.pdf
    • https://cdn.shopify.com/s/files/1/0430/7078/3645/files/pomepabulefarodoboxim.pdf
    • https://cdn.shopify.com/s/files/1/0429/6949/7753/files/29901677394.pdf
    • https://cdn.shopify.com/s/files/1/0432/4291/3955/files/56002415729.pdf
    • https://cdn.shopify.com/s/files/1/0431/4100/5480/files/koseluxaxama.pdf
    • https://cdn.shopify.com/s/files/1/0433/4069/3662/files/vimivibejo.pdf
    • https://cdn.shopify.com/s/files/1/0431/0587/8167/files/3075238441.pdf
    • https://cdn.shopify.com/s/files/1/0434/0757/3157/files/kujazewetujoxerowiwu.pdf
    • https://cdn.shopify.com/s/files/1/0429/6137/1290/files/21588616583.pdf
    • https://cdn.shopify.com/s/files/1/0439/7318/1598/files/xixikixegepaxe.pdf
    • https://cdn.shopify.com/s/files/1/0430/4021/1097/files/viwapibefuzikin.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/12339474235.pdf
    • https://cdn.shopify.com/s/files/1/0432/0873/6928/files/kexulugomojagasaxugaxiti.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058eb.bin
14a876ddc494beca2dcb522e4c0243420ac959e6f6152862e67240a4d5af0ad3
pdf-font-stream PDF embedded font (sfnt) at offset 0x58EB 4992 bytes
font_01_sfnt_off000069e3.bin
5b5a66549a897e28b5376154a9f2dab535c52919fe124cde92b2be75c9ea9834
pdf-font-stream PDF embedded font (sfnt) at offset 0x69E3 9944 bytes