Malicious PDF — malware analysis report

Static analysis result for SHA-256 2308260f2243afb2…

MALICIOUS

PDF

37.4 KB Created: 2020-08-19 04:20:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7f3f66e3efe7f55fae627b8b09490daf SHA-1: 27709f661d1a15c2338a9ca41304bffdd983d93d SHA-256: 2308260f2243afb2753b8a65f4345afc3d2f1f8d2d2b35d07c786a9d47d48f57
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to a 'teacher aide job description' and includes the malicious URL. This suggests a phishing or social engineering lure, aiming to direct users to potentially harmful content via the identified redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=teacher+aide+job+description+pdf
    • http://katilurex.ivonnegalanes.com/uploads/1/3/1/3/131381006/bobojodagopokutumiki.pdf
    • https://cdn.shopify.com/s/files/1/0433/3246/8904/files/mosfet_datasheet_parameters.pdf
    • https://cdn.shopify.com/s/files/1/0434/6652/2790/files/pexenuderobozibu.pdf
    • https://cdn.shopify.com/s/files/1/0428/3842/5766/files/74714313214.pdf
    • https://cdn.shopify.com/s/files/1/0430/3434/5625/files/alopurinol_posologia.pdf
    • https://cdn.shopify.com/s/files/1/0429/8833/9361/files/fivunikuwufurabigadoz.pdf
    • https://cdn.shopify.com/s/files/1/0435/3628/5860/files/fakumab.pdf
    • https://cdn.shopify.com/s/files/1/0434/9820/9446/files/flyer_template_ms_word.pdf
    • https://cdn.shopify.com/s/files/1/0433/9564/5589/files/pezexerelilov.pdf
    • https://cdn.shopify.com/s/files/1/0440/4304/2966/files/rolesibaferarutu.pdf
    • https://cdn.shopify.com/s/files/1/0430/1363/6259/files/gujagozazafoloba.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/50878135704.pdf
    • https://cdn.shopify.com/s/files/1/0428/4622/4551/files/80947316350.pdf
    • https://cdn.shopify.com/s/files/1/0430/9437/6599/files/seafoam_islands_fire_red.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005448.bin
c44916ab93fcb6b1328c61a8472f2b7025ef2453ff3bff11c81e7274cba6774f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5448 5376 bytes
font_01_sfnt_off00006683.bin
0ba1a7dac0fa799808c012c8bbccefff3b23fa413ce3da4f9e570d2ced07b082		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6683 10032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.