Malicious PDF — malware analysis report

Static analysis result for SHA-256 454931f3887fbb19…

MALICIOUS

PDF

36.5 KB Created: 2020-09-02 22:05:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81e2d64646c4e24f7e73eaceb40cbf78 SHA-1: 8ba2a33d081cbbcae9afdddd098e82e2c5074952 SHA-256: 454931f3887fbb19ddcae6c4e5d2556e9955483803bfda1c8cd46d8c99c2d99b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'printable coloring sheets of cars' and the malicious URL. This suggests a social engineering lure to drive traffic to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=printable+coloring+sheets+of+cars
    • https://static.usrfiles.com/ugd/9219f8_a3494ec47e304e738ef8483d6e00693d.pdf
    • https://static.usrfiles.com/ugd/ec0c41_4ec01451c91742d3a2601da78710d1e1.pdf
    • https://static.usrfiles.com/ugd/6846fe_6f58c20e11e449aba927e6c4b490094f.pdf
    • https://static.usrfiles.com/ugd/a12125_01e67ccc5db940a09d53a661b2c22cbb.pdf
    • https://static.usrfiles.com/ugd/361045_8cb1759aac3f4ca784b642a586237fb6.pdf
    • https://static.usrfiles.com/ugd/b8c837_e51e4b763c4d4ca480252d4b11fa2a4e.pdf
    • https://static.usrfiles.com/ugd/b8c837_d2a1fcf02e7b413fa64c9be161872fc0.pdf
    • https://static.usrfiles.com/ugd/de3d83_fdfe46cd76ea4b01be7089c9f88d272a.pdf
    • https://static.usrfiles.com/ugd/b8c837_a7dd1623cdc14e0389253627334ffbe6.pdf
    • https://static.usrfiles.com/ugd/89c6ad_b927c0b1791943e9a69835cadc84a8bc.pdf
    • https://static.usrfiles.com/ugd/735189_dc1b190358dd4988a6d3bccf5f2612c1.pdf
    • https://static.usrfiles.com/ugd/b8c837_f8cd5ee44960487a982fb377bac65caf.pdf
    • https://static.usrfiles.com/ugd/22bf55_a27a6623736c4f84be9ed0b608cdb6a7.pdf
    • https://static.usrfiles.com/ugd/9dda13_4f379ab9ad4449cd890cadda2979263d.pdf
    • https://static.usrfiles.com/ugd/455f95_e34fb376faaf4ff4bc7b1e50ab97578e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000050b8.bin
1d3b04f734affeb29df6363fe8fb05e6fdb61e2129c251b3407bd83f2df184c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50B8 5284 bytes
font_01_sfnt_off000062ac.bin
d19abf1e775e4710a5dfdd9ee51ea5c51ee8557127cb1a4cf32ef1dbc97ba375		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62AC 10128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.