Malicious PDF — malware analysis report

Static analysis result for SHA-256 3820ee0aeaaaf299…

MALICIOUS

PDF

181.3 KB Created: 2020-08-14 20:02:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64ceaa359d51e64677b950416a0841bd SHA-1: df1cebe084bc62f0a0bf9f3c09cfcb8d8c710fce SHA-256: 3820ee0aeaaaf29951ea73cee3efb6b5b679c637eb254619b208dd7739989abd
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The embedded URL, https://ttraff.cc/wb?keyword=words%20with%20meaning%20and%20sentence%20pdf, is identified as malicious. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The file's purpose is to trick users into clicking this link, likely leading to a phishing page or malware download.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=words%20with%20meaning%20and%20sentence%20pdf
    • http://kazarovew.essexcountyhatchery.com/uploads/1/3/0/8/130874064/kupevidow.pdf
    • http://files.msmeiningersclass.com/uploads/1/3/1/3/131383548/lofinesifoluxilir.pdf
    • https://cdn.shopify.com/s/files/1/0432/1892/7776/files/xavobixoxijo.pdf
    • https://cdn.shopify.com/s/files/1/0433/4885/2891/files/5344042591.pdf
    • https://cdn.shopify.com/s/files/1/0433/9780/8279/files/arquetipos_del_inconsciente_colectivo.pdf
    • https://cdn.shopify.com/s/files/1/0433/3237/0590/files/89162113982.pdf
    • https://cdn.shopify.com/s/files/1/0440/2728/1558/files/xurufijibifixifawevexis.pdf
    • https://cdn.shopify.com/s/files/1/0437/0703/9897/files/dajotenotatusuxifelegezaz.pdf
    • https://cdn.shopify.com/s/files/1/0437/4154/4600/files/91797525530.pdf
    • https://cdn.shopify.com/s/files/1/0434/2677/5196/files/dojowinajafaxubowojanore.pdf
    • https://cdn.shopify.com/s/files/1/0430/9234/4993/files/xokamoxenu.pdf
    • https://cdn.shopify.com/s/files/1/0437/0379/5865/files/jinumuvupu.pdf
    • https://cdn.shopify.com/s/files/1/0431/9094/3901/files/99114288064.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/mowojemabedeju.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00028f6f.bin
0d602675d71dbb41d39f4f403d0d47690a09b0233eb6684e099c5db1f060d97c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28F6F 5640 bytes
font_01_sfnt_off0002a29f.bin
b1d8960e396572cade7eaafced7181cfe99b78eaf642af8c86f5368e3f854171		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A29F 11100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.