Malicious PDF — malware analysis report

Static analysis result for SHA-256 4453d05f28f74d42…

MALICIOUS

PDF

46.2 KB Created: 2020-09-02 05:02:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a2126e5144ef1b3ef35c22bbad05164 SHA-1: ec9d4494402a35a7c989efbe3221e340cd2e29ab SHA-256: 4453d05f28f74d423ed0316c94112317abaec44764d72904640861c84916d411
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to a malicious URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to 'Uc browser apkpure' and the malicious URL, suggesting a lure to download potentially unwanted software or malware. The PDF also contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic, further supporting a malicious intent to redirect users to external sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=uc+browser++apkpure
    • https://static.usrfiles.com/ugd/9c0842_b24da8ff297e40eeb8747528caa2a455.pdf
    • https://static.usrfiles.com/ugd/33c377_8eb1658ee42f41109213c501081bc1bf.pdf
    • https://static.usrfiles.com/ugd/122077_33253477b0394c87a41716f2bf0ca31e.pdf
    • https://static.usrfiles.com/ugd/9a242c_cf35811b8e7847828e8ce377caedf8cc.pdf
    • https://static.usrfiles.com/ugd/b8c837_e3adabb3da63441b94fc10baf91845ec.pdf
    • https://static.usrfiles.com/ugd/30e015_75156aff064f4477b43425216c19581b.pdf
    • https://static.usrfiles.com/ugd/c0fca2_d9c1feef25e84e41ac888c8ef643c439.pdf
    • https://static.usrfiles.com/ugd/b8c837_25f721a07d224e1392216c32a96e24b1.pdf
    • https://static.usrfiles.com/ugd/6f9b04_985ec1f2d8b548b5ad6153f7a5c138d0.pdf
    • https://static.usrfiles.com/ugd/ac72e0_ae64a10170f44e33a06496a52e9f65cc.pdf
    • https://cdn.shopify.com/s/files/1/0431/3173/2132/files/17016610413.pdf
    • https://cdn.shopify.com/s/files/1/0430/0544/4259/files/gasification_of_coal.pdf
    • https://cdn.shopify.com/s/files/1/0437/4993/3208/files/rojolaguxoxerowav.pdf
    • https://cdn.shopify.com/s/files/1/0430/6183/7981/files/40349055585.pdf
    • https://static.usrfiles.com/ugd/d4a9d6_d189970012094e1f97e6b28f057771a2.pdf
    • https://static.usrfiles.com/ugd/89363e_4144d33e6eac418a8ce47df0c2ff9ae6.pdf
    • https://static.usrfiles.com/ugd/b85eb0_9132c1e91f9f41f687fa2bfb96073f4a.pdf
    • https://static.usrfiles.com/ugd/cac9e4_24032802666c4fc98c816e87026b2825.pdf
    • https://static.usrfiles.com/ugd/b8c837_7859c7c65faa4e118d26c53da8b0fea7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054ee.bin
3d82fc2bd5ec979faa36b2b4fe7ffb6751e1122ce36a8f7a236dff456eef6f57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54EE 4832 bytes
font_01_sfnt_off00006571.bin
5098937f6204f3016803c39de4578a1cd845271a21f5936fdfabe3fb476117fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6571 10140 bytes
font_02_sfnt_off00008853.bin
9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8853 16092 bytes
font_03_sfnt_off00009d1a.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D1A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.