Malicious PDF — malware analysis report

Static analysis result for SHA-256 391a04579ed149a3…

MALICIOUS

PDF

58.5 KB Created: 2020-08-30 23:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 40016e923a05995287438c61aa59cf49 SHA-1: 52eea9957833688306779e46b453f264402b8391 SHA-256: 391a04579ed149a30e27b9f25ed684a4504a1462501b4a66b80e430e2fe77257
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to external PDF files hosted on static.usrfiles.com, forming a link farm. One of the primary links, https://ttraff.cc/wix?keyword=nh%25E1%25BB%25AFng+qu%25C3%25A1n+cafe+%25E1%25BB%259F+nguy%25E1%25BB%2585n+kh%25C3%25A1nh+to%25C3%25A0n, is flagged as a malicious redirector. This suggests a social engineering attack aimed at directing users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=nh%25E1%25BB%25AFng+qu%25C3%25A1n+cafe+%25E1%25BB%259F+nguy%25E1%25BB%2585n+kh%25C3%25A1nh+to%25C3%25A0n
    • https://static.usrfiles.com/ugd/08fe48_94064dbf2eb541bea7e7a873d61fa116.pdf
    • https://static.usrfiles.com/ugd/dba42a_380319f60cd54ccaa13c66fa399c10fe.pdf
    • https://static.usrfiles.com/ugd/b8c837_0a4efbfdb90b458abc7854d09df9785c.pdf
    • https://static.usrfiles.com/ugd/d775a9_16fb1c73d36b4b929c4f08626f23c4a1.pdf
    • https://static.usrfiles.com/ugd/b13fd1_b3d855328a204147a3f3d8be42ae4b22.pdf
    • https://static.usrfiles.com/ugd/f63f29_2ea8ac1a460e4c2da875c9dc63161f4c.pdf
    • https://static.usrfiles.com/ugd/b8c837_cee14021b15d486f9ed32e7362f66a60.pdf
    • https://static.usrfiles.com/ugd/b8c837_ad839648952a4f50aded2fd2e65d4f8a.pdf
    • https://static.usrfiles.com/ugd/b8c837_411da9f96bd64d42b5d9faf7ff2e1b4c.pdf
    • https://cdn.shopify.com/s/files/1/0427/7963/9967/files/wipanuxojemewididogudixu.pdf
    • https://cdn.shopify.com/s/files/1/0432/3665/5259/files/ronerelupuvokixutig.pdf
    • https://cdn.shopify.com/s/files/1/0438/1586/2434/files/agricultural_engineering.pdf
    • https://cdn.shopify.com/s/files/1/0435/8055/5419/files/literary_devices_high_school.pdf
    • https://cdn.shopify.com/s/files/1/0433/8276/7779/files/peralaxidekuwuxisajusog.pdf
    • https://cdn.shopify.com/s/files/1/0430/4211/1637/files/bedu_pako_baramasa_full_video_song.pdf
    • https://cdn.shopify.com/s/files/1/0437/8407/7473/files/simobisege.pdf
    • https://cdn.shopify.com/s/files/1/0428/2561/3475/files/25402838326.pdf
    • https://cdn.shopify.com/s/files/1/0431/2521/1296/files/nebefux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0437/8407/7473/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000762c.bin
913adeef7ac409750a1df155f4fcd6d493bae4a3b004f84c6dba00e10def2189		 pdf-font-stream PDF embedded font (sfnt) at offset 0x762C 6268 bytes
font_01_sfnt_off000089e1.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89E1 1800 bytes
font_02_sfnt_off0000926e.bin
cdf7b14e2ac2520e45b512f2af19bdf16f8812bbb35cebe0296afa7ffcc0605e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x926E 22316 bytes
font_03_sfnt_off0000c3bd.bin
069f5cdcb972b33999f3dc18a3e5b847fc2aa024b7c5b45b4734cedf253a8e5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC3BD 16376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.