Malicious PDF — malware analysis report

Static analysis result for SHA-256 2522b9cff6544d13…

MALICIOUS

PDF

38.3 KB Created: 2020-08-19 22:54:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f7760d08390941219aae0043d0dcb9d7 SHA-1: 48cb5f94fe30d86b10447fdb96fa83ff799f3e50 SHA-256: 2522b9cff6544d13c13570d0aa559fa0e0f9abbc089bd9c3dd29912af4139a6a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, specifically pointing to a URL designed to lure users with the promise of locating a lost Android phone. This is further supported by a heuristic indicating a callback phishing or tech-support scam pattern, consistent with the document body's content. The embedded URL https://ttraff.cc/pify?keyword=localizar+mi+telefono+android+perdido is the primary IOC, likely leading to a malicious site.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=localizar+mi+telefono+android+perdido
    • http://baxikisu.kevinmoldenhauer.com/uploads/1/3/0/8/130874038/6cde48abb10748c.pdf
    • http://mazegij.lakeviewtherapygroup.com/uploads/1/3/0/8/130873995/a2874.pdf
    • http://files.kcpym.org/uploads/1/3/0/7/130776661/gunedowitapaxufin.pdf
    • https://cdn.shopify.com/s/files/1/0431/7744/3483/files/9896135398.pdf
    • https://cdn.shopify.com/s/files/1/0437/3518/7605/files/16372108926.pdf
    • https://cdn.shopify.com/s/files/1/0427/6604/1244/files/vedowebafepi.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/tagesagebog.pdf
    • https://cdn.shopify.com/s/files/1/0430/2218/8701/files/70116996745.pdf
    • https://cdn.shopify.com/s/files/1/0433/2044/3045/files/campbell_biology_9th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0433/3201/0152/files/systematic_approaches_to_a_successful_literature_review_2020.pdf
    • https://cdn.shopify.com/s/files/1/0428/4638/8380/files/kanunidatinuwumuku.pdf
    • https://cdn.shopify.com/s/files/1/0430/4257/0401/files/sefos.pdf
    • https://cdn.shopify.com/s/files/1/0450/9430/5957/files/oblivion_game_of_the_year_edition_strategy_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005971.bin
6b6d788acffc1694c2cbd2b68c83d350a82e8d261ca13d9098bc7fb1719aa034		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5971 5112 bytes
font_01_sfnt_off00006abe.bin
ce763e6e2b41d97fdba62d8e1d3aaf79d16ba81e87e5d466b4890572dfc3f0f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6ABE 9836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.