Malicious PDF — malware analysis report

Static analysis result for SHA-256 46e7a17090d12b0b…

MALICIOUS

PDF

38.5 KB Created: 2020-08-23 20:09:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4a2830a303728f5fb013d92b159091d9 SHA-1: ba4abfb78f8c1763978682759da9a7e312376490 SHA-256: 46e7a17090d12b0b2e1f7c3d3a7e39d91d7f0ee562d8a0ea4563dd44b29beca5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, directing users to 'https://ttraff.cc/pify?keyword=best+whatsapp+status+malayalam'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, many of which point to Shopify domains. The document body, though heavily corrupted, contains fragments of the lure text and the malicious URL. The primary attack pattern involves social engineering through deceptive links within the PDF.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=best+whatsapp+status+malayalam
    • http://wajuwogi.dalysongs.com/uploads/1/3/1/3/131398069/paruzozeb-dikilezo.pdf
    • http://files.chappaquaptastem.com/uploads/1/3/1/3/131378942/juruz.pdf
    • http://files.fromaboveyouthcenterandbakery.com/uploads/1/3/1/8/131871781/1727ab85.pdf
    • http://files.villageroyaleanimalclinic.com/uploads/1/3/1/4/131438111/87b5f56.pdf
    • http://tewewudob.sarahwhipple.com/uploads/1/3/1/4/131438157/kugufipo.pdf
    • https://cdn.shopify.com/s/files/1/0427/4946/0636/files/pivomunaso.pdf
    • https://cdn.shopify.com/s/files/1/0432/0083/9842/files/negative_utilitarianism.pdf
    • https://cdn.shopify.com/s/files/1/0436/1424/0931/files/american_pageant_history_book.pdf
    • https://cdn.shopify.com/s/files/1/0429/8519/3625/files/58378494051.pdf
    • https://cdn.shopify.com/s/files/1/0440/8056/2326/files/75354533564.pdf
    • https://cdn.shopify.com/s/files/1/0433/1703/5166/files/35906795288.pdf
    • https://cdn.shopify.com/s/files/1/0432/9334/3902/files/tsubaki_soul_eater.pdf
    • https://cdn.shopify.com/s/files/1/0438/9293/2763/files/62673800244.pdf
    • https://cdn.shopify.com/s/files/1/0434/3670/3900/files/75589712987.pdf
    • https://cdn.shopify.com/s/files/1/0429/6274/7548/files/43734471506.pdf
    • https://cdn.shopify.com/s/files/1/0434/4895/9141/files/invitation_to_meeting_letter_template.pdf
    • https://cdn.shopify.com/s/files/1/0431/1570/8573/files/lukajekuparejerevinekun.pdf
    • https://cdn.shopify.com/s/files/1/0434/0154/3831/files/79568312725.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f58.bin
c2b93e20228ba2f6eee90f025e7433c59382e89849b6ac3ee49c88be1d4d200b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F58 5208 bytes
font_01_sfnt_off0000610e.bin
182783dbbce502952d58b2ba47e62324312f52c3c9af729ec0ab4ba4ccacfc2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x610E 13412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.