Malicious PDF — malware analysis report

Static analysis result for SHA-256 46199b0cd326d9bb…

MALICIOUS

PDF

52.0 KB Created: 2020-08-31 07:08:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 643f119af4699539c2db2e051a963ceb SHA-1: 9ba0057f62ed1927568441c5e0394d50a19575bb SHA-256: 46199b0cd326d9bb6d14214838566c2f947f4d04be0448a0e298bcd0cbe58da8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a URL identified as a malicious redirector. The document body, though partially corrupted, includes the title 'Lancelot ou le chevalier de la charrette questionnaire' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The presence of a malicious redirector link is the primary indicator of malicious intent.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=lancelot+ou+le+chevalier+de+la+charrette+questionnaire
    • https://static.usrfiles.com/ugd/b8c837_aa8cf9795c584fa1aabfd951385e264b.pdf
    • https://static.usrfiles.com/ugd/39cb9d_db07130c8f00447785505d2d8c145d35.pdf
    • https://static.usrfiles.com/ugd/b8c837_04ba36cb25b14989b3ddd3fe3d2cb6fb.pdf
    • https://static.usrfiles.com/ugd/b8c837_ca7bd45308a040af9b29010b968ec1ce.pdf
    • https://static.usrfiles.com/ugd/b8c837_826a851c5d5447ac81c139f32c7ff403.pdf
    • https://static.usrfiles.com/ugd/0c41e7_11dad7fdadcd43d8ae80facdf374b094.pdf
    • https://static.usrfiles.com/ugd/b8c837_73340e03bf734e0db3ff44b49dbedbd9.pdf
    • https://static.usrfiles.com/ugd/b8c837_0efc339b98e747a992879437c9e52293.pdf
    • https://static.usrfiles.com/ugd/b8c837_a8298549005b4d39998f7f2e7733af31.pdf
    • https://cdn.shopify.com/s/files/1/0472/3179/5365/files/repirudotobo.pdf
    • https://cdn.shopify.com/s/files/1/0437/3685/8773/files/honda_harmony_ii_hrt216_manual.pdf
    • https://cdn.shopify.com/s/files/1/0430/3519/7602/files/99237465691.pdf
    • https://cdn.shopify.com/s/files/1/0440/7921/8840/files/engineering_drawing_agarwal_download.pdf
    • https://cdn.shopify.com/s/files/1/0437/0608/9640/files/61399224759.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000088e0.bin
0baacbbfc13e65ea5dd5d238a31276229752e140fb5446b3be701f55b7576184		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88E0 5152 bytes
font_01_sfnt_off00009a5c.bin
b6c3e04a9fda751633443603a094b2d8f5eed5ddf8206d4b5af954bd255f3475		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A5C 12380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.