Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdce9d2cd946c40a…

MALICIOUS

PDF

40.3 KB Created: 2020-08-31 16:57:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 967291cfafe98350c7a004a3d0022ddc SHA-1: 8c46bfc761d54c7f4448265a5dc6e28d8e433d72 SHA-256: fdce9d2cd946c40a708c637c800b6139790be3806eecb96e53980de0a7d87cdd
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains embedded JavaScript and a critical heuristic firing for a malicious redirector link pointing to ttraff.ru. This indicates the document is designed to lure users to malicious infrastructure. Additionally, the PDF exhibits characteristics of a link farm, with numerous embedded links to external PDFs, likely to manipulate search engine results or distribute further payloads. The embedded JavaScript and the malicious redirector link suggest an attempt to download and execute a second-stage payload.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=wurth+sound+deadening+sheets
    • https://cdn.shopify.com/s/files/1/0433/9426/9333/files/39478703254.pdf
    • https://cdn.shopify.com/s/files/1/0433/9941/3925/files/kavafududigito.pdf
    • https://cdn.shopify.com/s/files/1/0434/6540/8662/files/ladopesabimuxabin.pdf
    • https://cdn.shopify.com/s/files/1/0438/6609/5781/files/vixafabegodizaredexol.pdf
    • https://static.usrfiles.com/ugd/d1d005_cc39f10b75a1447ca6d4ebff96fe6694.pdf
    • https://static.usrfiles.com/ugd/e42ee3_0da4ae39403043dd92b38993259fcaa7.pdf
    • https://static.usrfiles.com/ugd/b8c837_c0580a59b5d24efdaaf91aa64aa08d9c.pdf
    • https://static.usrfiles.com/ugd/122077_b4dc3d1c93f84f14bb2b36b2dc291b45.pdf
    • https://static.usrfiles.com/ugd/cbdbb6_b43552ea7d5b4a2db84c49ea0413fdb4.pdf
    • https://cdn.shopify.com/s/files/1/0433/0615/6190/files/ejercicios_practicos_de_powerpoint_2010.pdf
    • https://cdn.shopify.com/s/files/1/0431/7960/6177/files/81928919468.pdf
    • https://cdn.shopify.com/s/files/1/0427/7790/3263/files/mepagubujifofukerosisudu.pdf
    • https://cdn.shopify.com/s/files/1/0431/6528/6564/files/rewota.pdf
    • https://cdn.shopify.com/s/files/1/0433/8896/0933/files/sejarah_pendidikan_islam_di_malaysia.pdf
    • https://static.usrfiles.com/ugd/99965f_32fc08a1447e4788964085f5e73e0628.pdf
    • https://static.usrfiles.com/ugd/162fe6_e0a7ed39281c47a09ef15fcbe62bde3b.pdf
    • https://static.usrfiles.com/ugd/de3d83_060c2d8c69fd4b7bb3fdad58ce982935.pdf
    • https://static.usrfiles.com/ugd/b8c837_a890250f56a84113a07372589ff5293c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004de9.bin
d0c5926c1305482ed4cdeffc32c736b7e425e417c32677e1e1b6d5f34ed81b1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DE9 4948 bytes
font_01_sfnt_off00005ec0.bin
d9b71e0ae2f69296b5dba98fd415e132de8a61257196d69b91d8f282f9260163		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EC0 12464 bytes
font_02_sfnt_off000085fa.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85FA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.