Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a4adc31eabb12a9…

MALICIOUS

PDF

55.0 KB Created: 2020-09-08 22:12:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90c2e9df9380e43bdea2f3ee2960ff5e SHA-1: 77390b87f34aa33ce06b54774dcfa3335dfb4119 SHA-256: 3a4adc31eabb12a9b117eb5fdf1b7d31311db7113c66a430689e4ad51f2c9477
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'big ideas math pre algebra worksheets' and the malicious URL, suggesting a lure to disguise the malicious intent. The heuristic firings confirm the presence of a malicious redirector and a link farm, indicating a phishing or scam attempt.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=big+ideas+math+pre+algebra+worksheets
    • https://static.usrfiles.com/ugd/b88e3d_4975f9560d9e44458eab301dd1109338.pdf
    • https://static.usrfiles.com/ugd/b8c837_685f752c2e35491fab12d5c193624096.pdf
    • https://static.usrfiles.com/ugd/1a94e8_1eb15288b3904dda87a01bf4f89699f4.pdf
    • https://cdn.shopify.com/s/files/1/0434/6963/5734/files/49853202096.pdf
    • https://cdn.shopify.com/s/files/1/0427/9032/2335/files/rozelosovedoziwufo.pdf
    • https://cdn.shopify.com/s/files/1/0432/1663/4016/files/93442386935.pdf
    • https://cdn.shopify.com/s/files/1/0431/0728/7206/files/69897664433.pdf
    • https://static.usrfiles.com/ugd/e50c99_9e28245fd76a415a9ef3e742b155d88e.pdf
    • https://static.usrfiles.com/ugd/87ad98_dcf38bb160234ab181854133d5c10dd4.pdf
    • https://static.usrfiles.com/ugd/3b6424_92cb7b1659d847fe936acfbef1c5f572.pdf
    • https://static.usrfiles.com/ugd/8a9bcc_4d345ef57e284bfa8df3a15d94e0e341.pdf
    • https://static.usrfiles.com/ugd/21b4a7_1df445107cc14ceaad39dbbac64db3a1.pdf
    • https://static.usrfiles.com/ugd/ffe0d3_158479d6dcc743e88ae8aece33ed7bf1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://static.usrfiles.com/ugd/b8c837

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009792.bin
63ad0fff33597a1f6bc2d60cbf5b0dc6dc00f4d5e444a5d0e9887f3aed82edf6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9792 5720 bytes
font_01_sfnt_off0000aaeb.bin
32eefe0b22136d600a2a7403193786a4082e9bb8e95a494487534f6f8602fc28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAAEB 10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.