Malicious PDF — malware analysis report

Static analysis result for SHA-256 23efd9596e0b70b5…

MALICIOUS

PDF

49.1 KB Created: 2020-08-08 15:09:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b40c831539952336f5d647418fd21430 SHA-1: d9a17a87a4e4e1d5b358bf4024c1241d4cfe3b4e SHA-256: 23efd9596e0b70b5b0ba4714b5449ea43c58fdb09cc7e8867aebfd6823c06cea
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm and a specific redirector URL that is flagged as malicious. The document body, though heavily obfuscated, contains text related to a 'gmat official guide' and the malicious URL, suggesting a lure to trick users into clicking. The presence of numerous external PDF links further indicates a link farm strategy, likely for SEO poisoning or distributing malicious content.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=gmat+official+guide+2020+bundle+pdf
    • http://files.mosherministries.com/uploads/1/3/0/9/130969440/zutevaninada.pdf
    • http://files.jasminethai-destin.com/uploads/1/3/1/4/131437669/7324567.pdf
    • http://files.zndaughtersdance.com/uploads/1/3/1/0/131069781/dc19de7df.pdf
    • http://files.lifestageusa.com/uploads/1/3/0/8/130814225/kufolitu.pdf
    • http://files.brickhousegc.com/uploads/1/3/1/3/131379280/00069eb041.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kamunikizesow.pdf
    • https://cdn.shopify.com/s/files/1/0430/9535/9641/files/fiwitazobovesasofipujufo.pdf
    • https://cdn.shopify.com/s/files/1/0434/6822/6725/files/actuators_and_sensors.pdf
    • https://cdn.shopify.com/s/files/1/0432/8367/7339/files/tozagokubumilopi.pdf
    • https://cdn.shopify.com/s/files/1/0430/0383/8615/files/fexivevuladujanig.pdf
    • https://cdn.shopify.com/s/files/1/0431/2226/2178/files/87245451029.pdf
    • https://cdn.shopify.com/s/files/1/0431/4379/0760/files/26440756727.pdf
    • https://cdn.shopify.com/s/files/1/0430/7176/6690/files/60263798513.pdf
    • https://cdn.shopify.com/s/files/1/0438/5406/9910/files/articulation_in_music.pdf
    • https://cdn.shopify.com/s/files/1/0451/2923/6645/files/chemistry_notes_for_ssc_exam.pdf
    • https://cdn.shopify.com/s/files/1/0435/9097/5647/files/vikarogoki.pdf
    • https://cdn.shopify.com/s/files/1/0432/8180/9558/files/ponidisojeguzuvezolase.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a2a.bin
699a36f0dc2d3440312eb5585716ad3f3fa0061c2d5ff853e0862e8112dc5c6b
pdf-font-stream PDF embedded font (sfnt) at offset 0x6A2A 5644 bytes
font_01_sfnt_off00007d3f.bin
6f87802999bad1159350e13cd09174f3d3005c5f7903dbfc10649cd85e0449a2
pdf-font-stream PDF embedded font (sfnt) at offset 0x7D3F 7148 bytes
font_02_sfnt_off000090a3.bin
6896712f15eece3624e1c381d5a4ab3dce29ed91339308b8bd636994a87632e1
pdf-font-stream PDF embedded font (sfnt) at offset 0x90A3 11204 bytes