Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cafea6b1fd5a21e…

MALICIOUS

PDF

55.1 KB Created: 2020-08-21 16:58:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75731759e00c5f26626e90aea02f8cea SHA-1: c63fe796c8e622007ee90add7f8bd92ca725509e SHA-256: 2cafea6b1fd5a21ece3f311a1d8cf1f71ca048157d8a71ba519252b8c32e4821
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to external resources. One critical heuristic firing indicates a malicious redirector link, specifically 'https://ttraff.cc/pify?keyword=chalte+chalte+movie+free++3gp', which is likely intended to lead the user to malicious content. Another critical heuristic identifies a PDF link farm, suggesting a coordinated effort to distribute links. The document body, though partially garbled, contains text related to a movie and the URL 'https://ttraff.cc/pify?keyword=chalte+chalte+movie+free++3gp', reinforcing the lure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=chalte+chalte+movie+free++3gp
    • http://files.cragglaw.com/uploads/1/3/1/6/131606755/teduw.pdf
    • http://sibefe.boecc.org/uploads/1/3/2/7/132712615/mamevirajen_welapi_nemije_jeweforose.pdf
    • https://cdn.shopify.com/s/files/1/0440/2806/8005/files/xefujikidotajanulumi.pdf
    • https://cdn.shopify.com/s/files/1/0429/1392/3228/files/75142680324.pdf
    • https://cdn.shopify.com/s/files/1/0431/1403/7397/files/gidugef.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/sarozasupevukofapunaxovu.pdf
    • https://cdn.shopify.com/s/files/1/0428/8220/3801/files/30600542197.pdf
    • https://cdn.shopify.com/s/files/1/0431/2986/4343/files/60364061080.pdf
    • https://cdn.shopify.com/s/files/1/0441/3816/8472/files/loraxopejoxupimibudiv.pdf
    • https://cdn.shopify.com/s/files/1/0433/5730/7039/files/duwerenoniv.pdf
    • https://cdn.shopify.com/s/files/1/0430/2100/9053/files/wozijusa.pdf
    • https://cdn.shopify.com/s/files/1/0431/9870/9918/files/86083662455.pdf
    • https://cdn.shopify.com/s/files/1/0437/8315/9969/files/bargaining_for_advantage_richard_shell_download.pdf
    • https://cdn.shopify.com/s/files/1/0431/6246/8503/files/gilikikuni.pdf
    • https://cdn.shopify.com/s/files/1/0433/5930/5880/files/12903865437.pdf
    • https://cdn.shopify.com/s/files/1/0431/0610/7552/files/suzebifinal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c2b.bin
75f8a7f482e4c5cc965e8eefb008619cc9b79e4c5ed895fee4bf02f66c1e470f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C2B 5180 bytes
font_01_sfnt_off00007de0.bin
7e6b62f70a5f6006fc33d2375810178b8080236f15ac0ca6bc04349e7ea5a98d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DE0 14776 bytes
font_02_sfnt_off0000abfe.bin
ead7fd593d7f5feef6f283420e9b55f8fa4552f107c64b0063d474dd3355abd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xABFE 16164 bytes
font_03_sfnt_off0000c117.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC117 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.