Malicious PDF — malware analysis report

Static analysis result for SHA-256 39a86231e080cdd1…

MALICIOUS

PDF

45.9 KB Created: 2020-08-31 07:50:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4dde8ad22e18f06104b09cb58af02cc5 SHA-1: 0db267cbdea7620737acf5509f30a736a32eb37d SHA-256: 39a86231e080cdd154958a0d235845291fa577d252f23fd30f854d9ad3e04e0f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a known malicious URL, disguised as a resignation letter. This suggests a phishing attempt to lure users to a malicious site. The PDF also contains a large number of external links, many of which point to benign Shopify domains, but the primary malicious link is the critical finding.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=resignation+letter+with+immediate+effect+due+to+family+illness
    • https://cdn.shopify.com/s/files/1/0427/7082/5382/files/warframe_moonlight_jadeleaf.pdf
    • https://cdn.shopify.com/s/files/1/0431/5955/2155/files/97039497411.pdf
    • https://cdn.shopify.com/s/files/1/0435/6446/6335/files/calculus_formulas_pdf_download.pdf
    • https://cdn.shopify.com/s/files/1/0431/7121/7565/files/jilaruwutijoseterajagane.pdf
    • https://cdn.shopify.com/s/files/1/0440/8295/4392/files/automatic_transmission_repair.pdf
    • https://static.usrfiles.com/ugd/2ac701_2e07abcbac6e44a0bbc474f519551f4b.pdf
    • https://static.usrfiles.com/ugd/4c1554_03117d2ac4c744e7a6f2653ce350a4d0.pdf
    • https://static.usrfiles.com/ugd/8d57bd_9e470f0ce64a44ca8cb259cd1b62eae9.pdf
    • https://static.usrfiles.com/ugd/b8c837_fe4d156699cb4103ae10e8fb5e5bc39a.pdf
    • https://static.usrfiles.com/ugd/ee6770_b66116e8ed644a069144ad9d5fb6c575.pdf
    • https://static.usrfiles.com/ugd/d94ae5_393c68161c62495caddf9269e7f59895.pdf
    • https://static.usrfiles.com/ugd/95089d_b0d2f53341c447d3b36d619107bebf8e.pdf
    • https://static.usrfiles.com/ugd/a44510_4df9a6cc3a52420e9d7f0983a4810b16.pdf
    • https://static.usrfiles.com/ugd/234f58_d3c67ca48d384f29a688f14bb57534f6.pdf
    • https://static.usrfiles.com/ugd/8b49c6_47a7106802d740d8a4105a931ddb6062.pdf
    • https://static.usrfiles.com/ugd/fb83f1_028fd72589724432addd71125c6bbb6c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072e2.bin
fce31f82e9bb179c6b073d39c8133d393aa9237724ea7872c26bfde4a293e32a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72E2 5636 bytes
font_01_sfnt_off000085f6.bin
ad7713054e708ebe32e8452b3722a31e20b34e14bbab861206e629a963b3623e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85F6 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.