Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe16b09ddb1a1840…

MALICIOUS

PDF

141.8 KB Created: 2020-08-19 08:43:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90a19fad2a136514884da2a145359113 SHA-1: 39c273e11c19980724c1a0058641b7a9aee404f2 SHA-256: fe16b09ddb1a1840184ff5a937a3e3e43fd41666d34bf366f6e21aa9fcfcbc70
220 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=drawing+book+file+type+pdf'. Additionally, it exhibits a link farm pattern with numerous PDF links hosted on Shopify, suggesting SEO manipulation for traffic redirection. The document also contains a critical heuristic for requesting recovery secrets, indicating a social engineering lure. The combination of these factors suggests the document is designed to trick users into clicking malicious links and potentially divulging sensitive information.

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=drawing+book+file+type+pdf
    • http://ladofuwo.tandersonart.com/uploads/1/3/0/8/130814471/1686387.pdf
    • http://viran.akidsplace-huntingburg.org/uploads/1/3/1/6/131607062/6571233.pdf
    • http://poxaf.groundzerovaping.com/uploads/1/3/2/6/132682646/e36677ff9c41e65.pdf
    • https://cdn.shopify.com/s/files/1/0438/3634/2434/files/29519367893.pdf
    • https://cdn.shopify.com/s/files/1/0434/0711/4391/files/42218237232.pdf
    • https://cdn.shopify.com/s/files/1/0433/8538/9206/files/best_entrepreneur_books_of_all_time_pdf.pdf
    • https://cdn.shopify.com/s/files/1/0429/7487/1711/files/sindrome_de_abstinencia_a_la_cafeina.pdf
    • https://cdn.shopify.com/s/files/1/0430/4610/9345/files/94954981679.pdf
    • https://cdn.shopify.com/s/files/1/0428/7443/7791/files/85652776029.pdf
    • https://cdn.shopify.com/s/files/1/0427/9674/4871/files/68534034926.pdf
    • https://cdn.shopify.com/s/files/1/0429/0324/0871/files/27140776123.pdf
    • https://cdn.shopify.com/s/files/1/0438/0141/1744/files/56330185758.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a499.bin
f02b8d832da4f2383e25187d92f247c37062c032865045bda6d4e9e62fd98b0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A499 4652 bytes
font_01_sfnt_off0001b4dd.bin
c0d8d1ed3cae0e190dcb6248f3302b2eae70cc20a24c07ce07d041ad770e96f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B4DD 5428 bytes
font_02_sfnt_off0001c770.bin
d97e055e11de589539a249dfdf9c15aca1e9caf4700104d1763a3a5d87d8f7f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C770 2320 bytes
font_03_sfnt_off0001d1c2.bin
aed0c9970a0f760ada96ed543bb71e5dac4879786e3b56112e4d4ff994493533		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D1C2 16444 bytes
font_04_sfnt_off000204cf.bin
207faf14306426b668b87aba0c9d447b8ba40b67f0f7b18660ffa0d3c8132265		 pdf-font-stream PDF embedded font (sfnt) at offset 0x204CF 16224 bytes
font_05_sfnt_off00021a57.bin
d2afed849a30ba6045977a85c0a4ded6777ff10e31c18f81e1af6ead543879ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21A57 3632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.