Malicious PDF — malware analysis report

Static analysis result for SHA-256 2939bf142be9fb7e…

MALICIOUS

PDF

48.9 KB Created: 2020-08-22 10:26:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: da37e440947750e3c455e55d2912ffb3 SHA-1: 41e3cff72e976427342cdd983f5ae60c69ab6b73 SHA-256: 2939bf142be9fb7e49cafc4ef5aba7d1cb91d93ad9b4fbcad1df95b100a12065
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded links, with one critical heuristic identifying a malicious redirector. The document body, though partially corrupted, contains text related to downloading an application and the malicious URL itself. This suggests the PDF is designed to trick users into visiting a malicious site, likely for phishing or malware distribution. The presence of a link farm heuristic further supports the malicious intent.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=baixar+whatsapp+plus+apk+atualizado+2018
    • http://jopipodi.bigmikeroadshow.com/uploads/1/3/1/1/131164250/botalusejifo.pdf
    • http://files.melindatuhus.net/uploads/1/3/0/7/130775102/bumilubuzidedu.pdf
    • http://files.thestringninja.com/uploads/1/3/2/7/132710753/7b96cbc.pdf
    • https://cdn.shopify.com/s/files/1/0432/4786/1923/files/cinquenta_tons_de_liberdade_completo.pdf
    • https://cdn.shopify.com/s/files/1/0431/3330/4986/files/bosch_axxis_dryer_manual.pdf
    • https://cdn.shopify.com/s/files/1/0433/5340/7646/files/ps4_emulator_for_pc.pdf
    • https://cdn.shopify.com/s/files/1/0432/7918/8118/files/37498542236.pdf
    • https://cdn.shopify.com/s/files/1/0430/1098/2041/files/stars_and_galaxies_note-_taking_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0438/3227/9190/files/66555541052.pdf
    • https://cdn.shopify.com/s/files/1/0431/0718/8898/files/52084589794.pdf
    • https://cdn.shopify.com/s/files/1/0446/3493/1363/files/neurological_disorders_treatment.pdf
    • https://cdn.shopify.com/s/files/1/0434/2090/9735/files/tenesarigesenibizefelufen.pdf
    • https://cdn.shopify.com/s/files/1/0437/7316/5725/files/wesavojad.pdf
    • https://cdn.shopify.com/s/files/1/0430/7881/1797/files/40_day_love_dare_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000724a.bin
b5ef8680b2b29f67bf62965b2b5d0c71713b7d1a96b4caa33c533cd68dd95bba
pdf-font-stream PDF embedded font (sfnt) at offset 0x724A 5888 bytes
font_01_sfnt_off0000866f.bin
6a77f955d39b9d81e75477a2b3a68a06f90d7b352a411c8fd057aba46c531b2e
pdf-font-stream PDF embedded font (sfnt) at offset 0x866F 2236 bytes
font_02_sfnt_off00009086.bin
66445ffd5aa61cb4c37c785ebc5a1c6fb43a47c785c39652599bfe97efebc3fb
pdf-font-stream PDF embedded font (sfnt) at offset 0x9086 11592 bytes