Malicious PDF — malware analysis report

Static analysis result for SHA-256 3925a2ddd4c1c01c…

MALICIOUS

PDF

39.1 KB Created: 2020-08-31 07:13:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53844bd2cf6448dd0abefe8a993193da SHA-1: 8412636c9bb6534d54c2e53afdd4f73508784376 SHA-256: 3925a2ddd4c1c01c907b7bb47877635d21339e5c4582fcdeb34b0e36fbfe89f8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded URLs, with one identified as a malicious redirector. This suggests the document is designed to lure users to malicious sites. The presence of a link farm further indicates a potential SEO poisoning or spamming campaign. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=trinomio+de+la+forma+ax%2525C2%2525B2+bx+c
    • https://static.usrfiles.com/ugd/b8c837_eedcbe1b79fb4250bed3d31a71959b16.pdf
    • https://static.usrfiles.com/ugd/4dd980_1a6332dc8e9d49179d8e6cfcce0a63b8.pdf
    • https://static.usrfiles.com/ugd/0ebc1f_73337580ee794978ab6d5451ebbd628c.pdf
    • https://static.usrfiles.com/ugd/d2cc1f_ffe33ccfaa584a3882cb96deef114c1f.pdf
    • https://static.usrfiles.com/ugd/b8c837_3457e671e6fb4533951ef01701bff528.pdf
    • https://static.usrfiles.com/ugd/b8c837_3d8d25558c324058b98cf572a12700a8.pdf
    • https://static.usrfiles.com/ugd/9dda13_2041b4011de2461b931dbf5507762d25.pdf
    • https://cdn.shopify.com/s/files/1/0466/8630/6468/files/lofodobugexuvulavipez.pdf
    • https://cdn.shopify.com/s/files/1/0433/3702/3641/files/amleto_inglese.pdf
    • https://cdn.shopify.com/s/files/1/0440/8036/5733/files/54547988750.pdf
    • https://cdn.shopify.com/s/files/1/0429/5150/8131/files/aristotle_beliefs.pdf
    • https://cdn.shopify.com/s/files/1/0431/3153/5509/files/tabizevotupuxopigawujawow.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005971.bin
c8650128b999440f09653b689acd114205a194352b7a180c8c1ad2ed283d96f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5971 5284 bytes
font_01_sfnt_off00006b5d.bin
b343059ee7268417a6ae8fcc0f679f1d783120078877a1a5d2fe065dc2c06dfa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B5D 10416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.