Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a1109ac00b11ed4…

MALICIOUS

PDF

137.9 KB Created: 2020-09-21 12:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 89413aa7d907f66f3e29a366c3faa7c3 SHA-1: b9ccd9ed5e5e1c21481de9d8ca6729ed138276a8 SHA-256: 3a1109ac00b11ed45664137c51db2f925b995a461dc7cefa1bc4561017243812
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic indicating it links to a known malicious redirector. The document body, though heavily obfuscated, contains the same URL. This suggests the primary goal is to redirect the user to a malicious site, likely for further exploitation or phishing. No scripts were extracted, limiting the analysis of specific execution chains.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=tokyo+facts+population
    • http://jewoxu.baytreelakesnc.com/uploads/1/3/1/0/131071191/mimub.pdf
    • http://teliwuko.auprophotography.com/uploads/1/3/2/6/132680974/0429ea77cc28bd.pdf
    • http://kowad.baroverbar.com/uploads/1/3/1/3/131383629/2367642.pdf
    • http://files.lindatrossart.net/uploads/1/3/0/9/130968985/kusevenimanotew-sutumumepuf.pdf
    • https://53f644b4-f3ca-4224-9515-0b05fffc97be.filesusr.com/ugd/f3cb45_42564411797b40e79eea70c2e0c4ce6e.pdf?index=true
    • https://5aafb4d3-1311-42a6-bc66-25102e35e7f0.filesusr.com/ugd/eb4c03_77135098b4354151af8e9cf9355bf5f0.pdf?index=true
    • https://a2839c43-9cc3-4440-b775-01cb0b156e9a.filesusr.com/ugd/fef806_6850035eb3a544e7afdbdb3ff79af769.pdf?index=true
    • https://e1366a43-433f-4f20-9083-38d85c4c2509.filesusr.com/ugd/23b571_fcda87316c2940878fe6d193ae9a7bff.pdf?index=true
    • https://9e09f5ed-d893-45a1-a18b-c65659b4e08b.filesusr.com/ugd/6e13d9_d7d0edb1a92940088b0396ab50dee5e5.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0437/7578/7162/files/dp_world_mundra_berthing_report_today.pdf
    • https://cdn.shopify.com/s/files/1/0443/5096/3868/files/45062205609.pdf
    • https://cdn.shopify.com/s/files/1/0464/7357/6616/files/spigen_tough_armor_tech_review.pdf
    • https://d988f6f2-75ac-4597-9e22-9519317196c2.filesusr.com/ugd/81d6a4_e4e071bb958841feae88e1a564abee7a.pdf?index=true
    • https://d573f041-d292-4e2f-9404-152ff36a4443.filesusr.com/ugd/dbbfd0_18b47bc66e9c43798514ff5a233e751f.pdf?index=true
    • https://1cad76a6-af87-4c90-b26a-ed7ead319156.filesusr.com/ugd/011e4b_a5c8729e56fb49de8cc6b42f04f31403.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001479d.bin
e9bc317e66eb6a7ceed1c788df30516943d607383567105644cf61700a27a449
pdf-font-stream PDF embedded font (sfnt) at offset 0x1479D 47232 bytes
font_01_sfnt_off0001d634.bin
7a7ae3b479fa3c9e7975f4b523f17e39355a31908286fbbca80075ebe05a0c31
pdf-font-stream PDF embedded font (sfnt) at offset 0x1D634 5028 bytes
font_02_sfnt_off0001e77b.bin
a5db59c7ae929a15f0e4ba9b47c20415d1fa526b387d876eb73704170585ebb4
pdf-font-stream PDF embedded font (sfnt) at offset 0x1E77B 16512 bytes