Malicious PDF — malware analysis report

Static analysis result for SHA-256 201546c15bf0cdeb…

MALICIOUS

PDF

95.4 KB Created: 2020-09-08 19:09:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18dd963c3ac4b8588246bfa59174aa4a SHA-1: 33d92205ff4a07949ea911c50f82a3f6e8597318 SHA-256: 201546c15bf0cdeba679e5350946f90ae60d5bf3d0bd23119c8b307eb68710ba
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains heuristics indicating it's a malicious redirector and an advance-fee scam lure. The document body, though heavily obfuscated, contains a URL that aligns with the redirector heuristic. This suggests the document's primary purpose is to trick the user into visiting a malicious site, likely for further exploitation or to initiate a scam.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=batman+return+to+arkham+review+game+informer
    • https://static.usrfiles.com/ugd/a18aa6_1c15c984bc6b481d941a22e6d6c6453a.pdf
    • https://static.usrfiles.com/ugd/cf5aa9_6cff1e3dd8914cf6bdfd3d5fd1dc0243.pdf
    • https://static.usrfiles.com/ugd/b8c837_132eb013f89043e59db09a7000f93195.pdf
    • https://static.usrfiles.com/ugd/defcb2_7f30d95dbc3f46409b00ab659b3a31d7.pdf
    • https://cdn.shopify.com/s/files/1/0431/5866/7415/files/97103536150.pdf
    • https://cdn.shopify.com/s/files/1/0438/8107/0747/files/87215582686.pdf
    • https://cdn.shopify.com/s/files/1/0428/9963/6390/files/36766476779.pdf
    • https://cdn.shopify.com/s/files/1/0465/5123/6766/files/download_wizkid_daddy_yo_video.pdf
    • https://cdn.shopify.com/s/files/1/0456/5198/4551/files/colts_injury_report_week_17.pdf
    • https://cdn.shopify.com/s/files/1/0438/1710/7618/files/suserusixuvo.pdf
    • https://cdn.shopify.com/s/files/1/0428/9839/1196/files/54300271633.pdf
    • https://cdn.shopify.com/s/files/1/0431/8789/6488/files/gurps_character_sheet_3rd_edition_pd.pdf
    • https://cdn.shopify.com/s/files/1/0463/0754/1149/files/bdo_xbox_failstack_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013aef.bin
ce6cf6c660c5793be96a453c6d55856d03a815c249386615a892eeac4c8462de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13AEF 5236 bytes
font_01_sfnt_off00014cb4.bin
3307a3a6f884ca1e764106fdbd6f4bf1ee3468e7f981fca902d472189affb748		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14CB4 10392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.