Malicious PDF — malware analysis report

Static analysis result for SHA-256 41bb5b8db949fa0f…

MALICIOUS

PDF

203.6 KB Created: 2020-08-04 02:56:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c357bf967d96c824ed1ec695a392b30 SHA-1: af9179e3aeb3409631548a97fc3a4ef1bd1f5afe SHA-256: 41bb5b8db949fa0f380f52dc403ab4f64c7150992798de6f3948a16f85b96dde
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/pify?keyword=beowulf+online+pdf+free'. The document body, though heavily obfuscated, also contains this URL, suggesting it is the primary lure. The file is a PDF, and the presence of embedded URLs and a malicious redirector indicates a phishing or social engineering attempt to lure the user to a malicious site.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=beowulf+online+pdf+free
    • http://files.chriskernutt.com/uploads/1/3/0/9/130969885/lixuwedujafedepoxidu.pdf
    • http://files.redseamsathletics.com/uploads/1/3/0/9/130968956/6039331.pdf
    • http://files.kavorka-racing.com/uploads/1/3/2/6/132682627/f3345.pdf
    • http://files.blinkchildrensartstudio.com/uploads/1/3/2/7/132741029/mokaxitovofe.pdf
    • http://sofilij.ingridsgymnastics.us/uploads/1/3/1/4/131453645/294b77859fe.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zafitizeruzu.pdf
    • https://cdn.shopify.com/s/files/1/0432/7066/8453/files/runadesofinidasom.pdf
    • https://cdn.shopify.com/s/files/1/0428/5949/5590/files/97598851277.pdf
    • https://cdn.shopify.com/s/files/1/0428/8849/5270/files/best_story_to_learn_english.pdf
    • https://cdn.shopify.com/s/files/1/0432/8197/3416/files/80824253064.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/94608223162.pdf
    • https://cdn.shopify.com/s/files/1/0428/0087/3631/files/kesafilijujifejoza.pdf
    • https://cdn.shopify.com/s/files/1/0431/3333/7768/files/muledesudeveg.pdf
    • https://cdn.shopify.com/s/files/1/0427/7128/4135/files/55090693053.pdf
    • https://cdn.shopify.com/s/files/1/0428/4815/7859/files/lstm_in_keras.pdf
    • https://cdn.shopify.com/s/files/1/0433/4449/4750/files/38665289928.pdf
    • https://cdn.shopify.com/s/files/1/0437/7369/0017/files/85695109431.pdf
    • https://cdn.shopify.com/s/files/1/0438/8909/8907/files/corsair_void_pro_mic_not_working.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002eb9b.bin
e1181038c0faef3c89d1985609104b399ab6f9f49d77f9061e29c3c3617b8d27		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EB9B 4788 bytes
font_01_sfnt_off0002fc0a.bin
e5e9f3ddc8163db8c8d17f0a95c14ec67242a6df156053df814828beedf5d95f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC0A 10712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.