Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6d033e21a3e6922…

MALICIOUS

PDF

47.9 KB Created: 2020-08-31 04:17:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 42aea235073f25384cf23754102c18ba SHA-1: fd6df3495b5c5ac088a951cd8d813ff77b5984cf SHA-256: f6d033e21a3e69223713dc6ea72bc4eada1e9434364cacc263337696c8da25da
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with one specifically identified as a malicious redirector. The heuristic PDF_SEO_LINK_FARM indicates a link farm designed to direct users to external resources. The primary malicious IOC is the URL https://ttraff.ru/wix?keyword=basic+sigil+magic, which is flagged as a malicious redirector. The document body itself is heavily obfuscated and appears to be largely junk data, but it does contain the malicious URL and several other benign-looking PDF links.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=basic+sigil+magic
    • https://static.usrfiles.com/ugd/b8c837_ef2b933a735040d496d20ab50877c2cd.pdf
    • https://static.usrfiles.com/ugd/db93e9_0bd57be146cc4636a2e283c1ae24baea.pdf
    • https://static.usrfiles.com/ugd/f46427_228c5173e00c4646a762019944a834b2.pdf
    • https://static.usrfiles.com/ugd/87b9a8_a89107970e3147a4a51aba30a08cc69e.pdf
    • https://static.usrfiles.com/ugd/67e251_4e3ae932c36242d4bc07374de0fea348.pdf
    • https://static.usrfiles.com/ugd/e745be_54e46ee505814f5da5b7b5a1835306e7.pdf
    • https://static.usrfiles.com/ugd/136d07_c741687fa50d4d029e5c2444b774d33b.pdf
    • https://cdn.shopify.com/s/files/1/0434/3093/6733/files/tipalexowojoraka.pdf
    • https://cdn.shopify.com/s/files/1/0435/6967/6451/files/fowles_advertising_s_fifteen_basic_appeals.pdf
    • https://cdn.shopify.com/s/files/1/0439/1125/0075/files/religious_definition_of_formalism.pdf
    • https://cdn.shopify.com/s/files/1/0435/5925/6232/files/adult_dvd_market.pdf
    • https://cdn.shopify.com/s/files/1/0434/0819/5738/files/84075339305.pdf
    • https://cdn.shopify.com/s/files/1/0433/2411/3049/files/the_reaper_s_image.pdf
    • https://cdn.shopify.com/s/files/1/0428/6627/8556/files/79008051724.pdf
    • https://cdn.shopify.com/s/files/1/0429/4072/7463/files/ribagadiditigexipok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007fe7.bin
0501483a2411b560142dc7e243b8d798353dceca707775f1887a650393a2b45a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FE7 5072 bytes
font_01_sfnt_off00009114.bin
7b6089d5cae957973be02f62868a8d0fe56fc6433f7a26bb2a4a92209bfdd964		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9114 10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.