Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb672b7bdd5ce4dd…

MALICIOUS

PDF

89.2 KB Created: 2020-08-23 01:06:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58a499051792aa1577dff85af4a81a87 SHA-1: f63e974d4ab6bc795d7512eaae561bcdc57ab2bd SHA-256: fb672b7bdd5ce4dda7d5435bbda4ebb4218edf47fb8c63e827dc0701d1dfc43e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links, many hosted on shopify.com. The document body, though heavily obfuscated, contains the same malicious URL. The primary intent appears to be redirecting users to malicious infrastructure, likely for phishing or to download further malware.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=hollywood+movie+speak+khmer+free
    • http://lepeporo.urbanedenbeauty.co.uk/uploads/1/3/1/4/131413418/5711969.pdf
    • http://files.channingbenjamin.com/uploads/1/3/1/8/131871558/virepinutes.pdf
    • https://cdn.shopify.com/s/files/1/0440/9671/6952/files/lolesisipixivufemikud.pdf
    • https://cdn.shopify.com/s/files/1/0430/7140/6234/files/22957120794.pdf
    • https://cdn.shopify.com/s/files/1/0428/6706/4991/files/virtual_function_java.pdf
    • https://cdn.shopify.com/s/files/1/0428/7106/2684/files/minecraft_medieval_fortress_book.pdf
    • https://cdn.shopify.com/s/files/1/0435/7410/0127/files/frigidaire_5000_btu_air_conditioner_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/womosoravitixugefiwil.pdf
    • https://cdn.shopify.com/s/files/1/0429/2732/5343/files/kofulutosodoxa.pdf
    • https://cdn.shopify.com/s/files/1/0431/4939/4080/files/temporary_internet_files_location_has_changed.pdf
    • https://cdn.shopify.com/s/files/1/0459/2451/5989/files/66563977005.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006bb3.bin
5c3782527b088610a5d85a07c168f86323dca6373f2a2620b1f5369ac9767bb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BB3 14140 bytes
font_01_sfnt_off000099c3.bin
2e7f5698cb53df8f5de8dd97146957677e0a98b637739059478b8cf9d24203a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99C3 5560 bytes
font_02_sfnt_off0000ac9c.bin
8c91e91df2f0ec744e923e8df979de700079d7d3aecb77777337e5045754f5dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAC9C 7340 bytes
font_03_sfnt_off0000c423.bin
52624895a4eadb7835eb9ef2a2b80599b286e622294c84fbd83ed78c14b406a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC423 2756 bytes
font_04_sfnt_off0000cf16.bin
d93379cace63e1a4bc02abcc509f764d4f8112460a1db9ebc2dac478fbaff1de		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF16 5028 bytes
font_05_sfnt_off0000de83.bin
36ef47ba4f87bc2e3b02cbfe1eedcdf64b9d2179b240eddf0e81b47fe8818133		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE83 3904 bytes
font_06_sfnt_off0000ed78.bin
5d302898de1a2e1f5c09152f4378f3908227f5a39904b07968592bc4f1e84836		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED78 7568 bytes
font_07_sfnt_off000101ea.bin
624a1392eada157d53a84688059d0e1cf9678482c36637e582b250434ea9f853		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101EA 11188 bytes
font_08_sfnt_off000125a3.bin
f11f775b34b0d7b26e0e1f3cef9c4c4e75fc8b780c7c2bbdaa1718536336acba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125A3 18120 bytes
font_09_sfnt_off000141e1.bin
d15980b2ce0d60408e9683f77e6e0dacf70f7ffadf8b080639c1a0cc99b8d43b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141E1 4960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.