Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b428c5290cb6f4b…

MALICIOUS

PDF

40.3 KB Created: 2020-09-01 07:20:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a5ca0b144a4ff4d48a4619d37f5e1ff SHA-1: 7dd1e29ddf2f9ad2156613f0dccf4a6fdfdf0e0d SHA-256: 4b428c5290cb6f4bd8ebf02db9ff0630526cd2f004f65a7eedcf5897a1ff2205
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a domain identified as a malicious redirector. The document body, though heavily obfuscated, contains strings that appear to be related to movie titles and the redirector URL itself, suggesting a lure to trick users into clicking malicious links. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=the+way+back++filmyzilla
    • https://static.usrfiles.com/ugd/fb83f1_d9fdce7d5a944244bc792322fb37ffa4.pdf
    • https://static.usrfiles.com/ugd/1fbf8b_579fb08de4c14b42b639f51f127b746b.pdf
    • https://static.usrfiles.com/ugd/e2f197_e910896fbadc4fce8956883f448b3e3d.pdf
    • https://static.usrfiles.com/ugd/73c254_365be75775914cb2ab303ac8c73c689e.pdf
    • https://static.usrfiles.com/ugd/87fdc7_beed41939ae84a83928146cb5a479625.pdf
    • https://static.usrfiles.com/ugd/3aee12_16fd0164c6c44ca9ab3181e5f822ccd1.pdf
    • https://static.usrfiles.com/ugd/ca300b_066206880bef47048b436fbdfd711c24.pdf
    • https://static.usrfiles.com/ugd/b8c837_9a2c7ab771be4782bb82ef33e6564db6.pdf
    • https://cdn.shopify.com/s/files/1/0459/8670/9666/files/4992884292.pdf
    • https://cdn.shopify.com/s/files/1/0429/5576/7967/files/ln46a650a1fxza_inverter_board.pdf
    • https://cdn.shopify.com/s/files/1/0431/3353/4357/files/felarabe.pdf
    • https://cdn.shopify.com/s/files/1/0431/2557/1733/files/14191455876.pdf
    • https://static.usrfiles.com/ugd/68ec51_fa149e5f004847c294901668295c92a6.pdf
    • https://static.usrfiles.com/ugd/32acb1_2a27cf580d0a4a89a7ad2f146915d55c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ffc.bin
b3f6e8e14961a1626d2d6cbe8b127206e3ad965b0bfc8b57c04983f7ed0f7f15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FFC 5244 bytes
font_01_sfnt_off000071da.bin
b266b5ab3ee949846714ed3f0bb582e14fcbcad65f34f1e19abeb77f7980a396		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71DA 10128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.