Malicious PDF — malware analysis report

Static analysis result for SHA-256 f835ca2d6cbeb9ee…

MALICIOUS

PDF

48.5 KB Created: 2020-08-12 06:19:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87651d64da6c7f76afaaa85d95dabfeb SHA-1: 9b2ec26ca632690e28013acca7e8db90c9aa7510 SHA-256: f835ca2d6cbeb9ee78bddd87a371360d8696d645b1c967c70ef956dfa85e9df9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with 30 external PDF links identified. One critical heuristic indicates these links point to a known malicious redirector infrastructure, specifically 'ttraff.ru'. While many linked Shopify URLs are confirmed benign, the presence of the redirector and the sheer volume of links suggest an attempt at SEO manipulation or a large-scale distribution of potentially malicious content. No scripts were extracted, and the document body was largely unreadable binary data.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=a+h+almaas+pdf
    • http://files.lvh2o.com/uploads/1/3/2/6/132681296/f6337cb4fd6c.pdf
    • http://nukige.duraesenterprise.com/uploads/1/3/0/7/130739678/4546183.pdf
    • http://files.rehanlab.com/uploads/1/3/0/8/130814340/zabimorokasikemoze.pdf
    • https://cdn.shopify.com/s/files/1/0438/5865/7430/files/matplotlib_update_plot.pdf
    • https://cdn.shopify.com/s/files/1/0427/7580/6119/files/92248075620.pdf
    • https://cdn.shopify.com/s/files/1/0431/9445/0078/files/western_stoneware_price_guide.pdf
    • https://cdn.shopify.com/s/files/1/0448/1653/1617/files/general_cognitive_ability_test_telkom.pdf
    • https://cdn.shopify.com/s/files/1/0429/7113/6154/files/69648600376.pdf
    • https://cdn.shopify.com/s/files/1/0435/6086/1845/files/adoption_agency_form.pdf
    • https://cdn.shopify.com/s/files/1/0434/6124/7129/files/vawiwidukitivi.pdf
    • https://cdn.shopify.com/s/files/1/0436/7548/4313/files/xikuvedirasopupa.pdf
    • https://cdn.shopify.com/s/files/1/0431/1639/6697/files/4634901555.pdf
    • https://cdn.shopify.com/s/files/1/0436/8737/9097/files/kaxavawumederovurowog.pdf
    • https://cdn.shopify.com/s/files/1/0432/0791/7729/files/mathematics_formula_in_tamil.pdf
    • https://cdn.shopify.com/s/files/1/0429/0985/9999/files/4402826529.pdf
    • https://cdn.shopify.com/s/files/1/0440/6794/6648/files/red_trofica_terrestre.pdf
    • https://cdn.shopify.com/s/files/1/0430/2936/4889/files/49886874575.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074b5.bin
9d015a071bbc0a6226b0fc7ab794d80fff487775306eb9472166c72056c9683a
pdf-font-stream PDF embedded font (sfnt) at offset 0x74B5 4500 bytes
font_01_sfnt_off000083ec.bin
6845b7cd3dff4b84fd882fa80a12743680e73ff7da711b561b0ec775aedb8368
pdf-font-stream PDF embedded font (sfnt) at offset 0x83EC 10416 bytes
font_02_sfnt_off0000a73d.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0xA73D 4324 bytes