Malicious PDF — malware analysis report

Static analysis result for SHA-256 23f5eb1098248d94…

MALICIOUS

PDF

48.0 KB Created: 2020-08-31 20:33:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7172c29bbfe97def2e39744f9b9dbf7 SHA-1: b1fb88c5d4d3667eadf712f44eacb6e3b99076fc SHA-256: 23f5eb1098248d94d5b8eaa1920358cb533ee3c4153744a63c4160d51a525162
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with one primary link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text that suggests an urgency lure, aligning with the SE_URGENCY_LURE heuristic. The primary malicious IOC is the redirector URL, which is likely used to deliver a secondary payload.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=writing+instructions+template+year+1
    • https://static.usrfiles.com/ugd/b8c837_52b1f7723aae4e51b8b7a0f5db87dec4.pdf
    • https://static.usrfiles.com/ugd/dd4472_983ededb504a4cc4b55ba1e3ae1f5e60.pdf
    • https://static.usrfiles.com/ugd/29c71c_73de85ad7d69463d9a7a858a9cc19403.pdf
    • https://static.usrfiles.com/ugd/0a052f_ffbb0b3be1114b0e8a8aabc71baad579.pdf
    • https://static.usrfiles.com/ugd/b8c837_0b7039da0d7347e782c7dc53500da723.pdf
    • https://static.usrfiles.com/ugd/b8c837_93acebf79db545608ff8a3e82f9c4b1b.pdf
    • https://static.usrfiles.com/ugd/253000_2bc93008d40f44bf90e5172082bbdf93.pdf
    • https://static.usrfiles.com/ugd/ae059d_fe3dca2b69ff4296bcbbd3992bd5f089.pdf
    • https://static.usrfiles.com/ugd/b8c837_43e3d64818224ac5b1e3f2e38b3bbd34.pdf
    • https://static.usrfiles.com/ugd/6290de_9078c46a2eec487abeb544b3f6915ff1.pdf
    • https://static.usrfiles.com/ugd/90423f_eb22ddfd324a45b59e91b1e8b382beae.pdf
    • https://static.usrfiles.com/ugd/b8c837_6422be812c0c43898afed07fbb5b8c8e.pdf
    • https://static.usrfiles.com/ugd/1e4819_6e919777b459445ababbd9b17bcfb742.pdf
    • https://static.usrfiles.com/ugd/cac9e4_d32940cb19374c61a75016bef2ae72f8.pdf
    • https://static.usrfiles.com/ugd/b8c837_e9bbb2f37b8c4450a50a5e3427f115dc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d84.bin
4a1cf622d5faa831594135935b6f25be297e45e65e935132c70784b97fd2da21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D84 5420 bytes
font_01_sfnt_off00008ffb.bin
79cbc4894342317a402c0c47092b9ea9ed58a94b9bf1cc1887d0f576aa6daf04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FFB 10336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.