Malicious PDF — malware analysis report

Static analysis result for SHA-256 e37a921e6361d9fa…

MALICIOUS

PDF

57.9 KB Created: 2020-09-06 00:50:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 72e1448881a94e52a8561c8da3b37126 SHA-1: d464581267750b0d380b50f0da20f30f0d02aa59 SHA-256: e37a921e6361d9fa2469f9aaefa51885025c61dc3a0ec7b0a1942270b63b4bec
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/wix?keyword=alfred+marshall+biografia+pdf'. The document body, though heavily obfuscated, contains this same URL, suggesting the primary intent is to redirect the user to a malicious site. The file also contains a heuristic for a PDF link farm, indicating a broader campaign to distribute malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=alfred+marshall+biografia+pdf
    • https://static.usrfiles.com/ugd/cbdbb6_8b3f06312a2f40a0bac30532d8aa833d.pdf
    • https://static.usrfiles.com/ugd/9e14ca_85bad5a8987c47e19cc7aee519e29149.pdf
    • https://static.usrfiles.com/ugd/e5412a_ffb32a2915ae4966959e0c6075519f40.pdf
    • https://cdn.shopify.com/s/files/1/0435/5384/9499/files/xipetaxoxevo.pdf
    • https://cdn.shopify.com/s/files/1/0431/2465/4241/files/wefobaselaruvikunogeda.pdf
    • https://cdn.shopify.com/s/files/1/0429/7087/4009/files/43023173301.pdf
    • https://cdn.shopify.com/s/files/1/0432/7460/0598/files/alzrc_devil_380_manual.pdf
    • https://cdn.shopify.com/s/files/1/0429/6320/6307/files/sowagutatesewodowuvuzi.pdf
    • https://static.usrfiles.com/ugd/b8c837_46e0c58e1bab46e691f51630ab7c73a6.pdf
    • https://static.usrfiles.com/ugd/cd79e3_da6d1494bdfb46a180b1f0cdea4fc610.pdf
    • https://static.usrfiles.com/ugd/b8c837_b89b70d13faa442ebdba2253dfcfa388.pdf
    • https://static.usrfiles.com/ugd/35e1ce_9d1dd1be26654a2cbd1cd08c7a09195c.pdf
    • https://static.usrfiles.com/ugd/850f07_a1e26621ef29436595c4c74376dc860a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a5a3.bin
45fe4769acbc8d20b2bd55ab06650b48ca1c06eee2b26bf505d5bc5462cd17a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA5A3 5584 bytes
font_01_sfnt_off0000b86d.bin
afa4f3e6eb844a6c3035cf9b786a35e2f71662047b14c185f9ccb8bfcd788c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB86D 9960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.