Malicious PDF — malware analysis report

Static analysis result for SHA-256 313fe117b208a8ae…

MALICIOUS

PDF

58.7 KB Created: 2020-08-31 03:51:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78b4368125849887e257c8738e5ece95 SHA-1: cb69852c054563030efcefd32bf5419b9768ad88 SHA-256: 313fe117b208a8aedb23c9f92a83a1f5220b75f8da8d764877138f141dc6def5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure related to an 'angelus prayer pdf' and includes the malicious URL. This indicates a social engineering attempt to trick users into visiting a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=angelus+prayer+pdf
    • https://cdn.shopify.com/s/files/1/0434/2379/3308/files/raxuxalovexat.pdf
    • https://cdn.shopify.com/s/files/1/0438/6629/2389/files/igcse_physics_paper_6_guide.pdf
    • https://cdn.shopify.com/s/files/1/0437/4550/9537/files/toro_824_snowblower.pdf
    • https://cdn.shopify.com/s/files/1/0435/9523/5490/files/17890848656.pdf
    • https://cdn.shopify.com/s/files/1/0439/2439/0056/files/jiruxakujenegupozurifel.pdf
    • https://cdn.shopify.com/s/files/1/0433/1382/3909/files/39589710657.pdf
    • https://cdn.shopify.com/s/files/1/0438/6009/9222/files/rarupiwonawudozuped.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fejekav.pdf
    • https://cdn.shopify.com/s/files/1/0433/6313/9733/files/23386744044.pdf
    • https://cdn.shopify.com/s/files/1/0438/8667/4088/files/cadver_exquisito_agustina_bazterrica.pdf
    • https://static.usrfiles.com/ugd/9b5f63_aca68ab62fa948458ff8fb09eda62b2a.pdf
    • https://static.usrfiles.com/ugd/cc14e4_efbd0e24158c4a4ea2ff1802cb7de595.pdf
    • https://static.usrfiles.com/ugd/b8c837_c5c3eec5cda04c8e9819206fed996b30.pdf
    • https://static.usrfiles.com/ugd/d3758e_62023fd64792474ba926c2da78933212.pdf
    • https://static.usrfiles.com/ugd/b8c837_2aa03b9f0ca9473d926d453b326addf1.pdf
    • https://static.usrfiles.com/ugd/b8c837_ce4376c3d3a342f391a01856abd891d4.pdf
    • https://static.usrfiles.com/ugd/8e1900_0feba203eea4467b98d44fd571fb4eb7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000090e3.bin
735fbd1f1ca80dc347b154751bd0a5bc5e27d819328ae506e1449927b92c4638
pdf-font-stream PDF embedded font (sfnt) at offset 0x90E3 5300 bytes
font_01_sfnt_off0000a303.bin
aa93139da7890f69c90f5e23dfbb7d14cc463bfd7e266ad9c47b0046b192d4a8
pdf-font-stream PDF embedded font (sfnt) at offset 0xA303 11040 bytes
font_02_sfnt_off0000c837.bin
d4dda1615a4364475d7d89fd1a7bbb7554fe073cd77351cd845804a7b4c90b1a
pdf-font-stream PDF embedded font (sfnt) at offset 0xC837 16300 bytes