Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3b932d4639363f1…

MALICIOUS

PDF

44.9 KB Created: 2020-08-14 10:45:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e11a36e823746014bcd5648de9d3f4f SHA-1: 3c4d05ab3c7b10bd95bf74470819bd397ad2fdf3 SHA-256: f3b932d4639363f12222ca668cc2000a41d5ac3721bae01ecd977e8880aefcc8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.ru'. The document body, though heavily obfuscated, contains the same URL and a reference to 'Apex legends character guide deutsch', suggesting a lure. The PDF also contains a large number of embedded links, many pointing to Shopify domains, which is indicative of a link farm used for SEO poisoning or to obscure the final malicious destination.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=apex+legends+character+guide+deutsch
    • http://luravokem.justzeusbooks.com.au/uploads/1/3/1/4/131452836/salenenuxajares.pdf
    • http://files.omahadeckcontractor.com/uploads/1/3/1/4/131407227/memukalevodisemale.pdf
    • http://vovax.roydesignedthat.com/uploads/1/3/1/3/131398101/0818cc31.pdf
    • https://cdn.shopify.com/s/files/1/0433/3341/9160/files/20389753066.pdf
    • https://cdn.shopify.com/s/files/1/0433/4603/4853/files/buzekakinonuxurusal.pdf
    • https://cdn.shopify.com/s/files/1/0434/3080/5669/files/94421528809.pdf
    • https://cdn.shopify.com/s/files/1/0427/5834/0774/files/jovofug.pdf
    • https://cdn.shopify.com/s/files/1/0438/9535/7595/files/sika_waterproofing_membrane.pdf
    • https://cdn.shopify.com/s/files/1/0434/4568/2328/files/bozikizotawif.pdf
    • https://cdn.shopify.com/s/files/1/0448/1286/1600/files/39757640042.pdf
    • https://cdn.shopify.com/s/files/1/0432/7922/0891/files/virus_y_bacterias_resumen.pdf
    • https://cdn.shopify.com/s/files/1/0432/1555/2674/files/goofy_movie_eye_to_eye.pdf
    • https://cdn.shopify.com/s/files/1/0432/7027/5236/files/tozuxezifuvuxetipava.pdf
    • https://cdn.shopify.com/s/files/1/0435/3291/0751/files/wudemijavewife.pdf
    • https://cdn.shopify.com/s/files/1/0431/6738/3712/files/jaxefalurefewakotasonutin.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/97285982277.pdf
    • https://cdn.shopify.com/s/files/1/0435/5335/7985/files/rafakesun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007233.bin
d8e8ccf60827bd1d371595ded2f6492b1bdcbdcfa6faa73f2de3cdcf26fe3f9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7233 5392 bytes
font_01_sfnt_off00008483.bin
50ef81e772d8713b55f8be837a731e66625d03d55ad13b76b2d5e4f295805bff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8483 9980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.