Malicious PDF — malware analysis report

Static analysis result for SHA-256 511d65472595681c…

MALICIOUS

PDF

54.5 KB Created: 2020-08-29 15:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7cc11c344fe1894f69e2a93c5bb781e0 SHA-1: 99f3d2411d25e65a2c08f9090481305e4a207454 SHA-256: 511d65472595681c63a14c3b94fc3b34fd9825ba234b2f80701f9cce77e530f4
268 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.003 Windows Command Shell T1059.001 PowerShell

The PDF contains multiple critical heuristic firings indicating it links directly to an executable payload and uses malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL pointing to 'vida+2014d+patch.exe', reinforcing the malicious intent. The presence of 'SE_CLIPBOARD_COMMAND_LURE' and 'SE_DOWNLOAD_BUTTON' heuristics suggests a social engineering tactic to trick the user into executing the downloaded file.

Heuristics 7

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=vida+2014d+patch.exe
    • https://static.usrfiles.com/ugd/b8c837_6a6f665af5514b05b9e37e5f8a6aa20c.pdf
    • https://static.usrfiles.com/ugd/b8c837_10a7e12eff0d436aa51fe9fcc597d09e.pdf
    • https://static.usrfiles.com/ugd/b8c837_f29b2a0d105f4ecba9aed31dac4f6fbc.pdf
    • https://static.usrfiles.com/ugd/b8c837_95e37550f5e44b318819e444bdd307da.pdf
    • https://cdn.shopify.com/s/files/1/0433/7877/0078/files/marriage_d_amour_guitar.pdf
    • https://cdn.shopify.com/s/files/1/0436/5064/6169/files/doom_3_cheats_ps3.pdf
    • https://cdn.shopify.com/s/files/1/0428/7732/1379/files/xozomamowo.pdf
    • https://cdn.shopify.com/s/files/1/0430/2975/8103/files/95060253752.pdf
    • https://cdn.shopify.com/s/files/1/0438/0504/8994/files/lufixaxixunuvomiwusuzofob.pdf
    • https://cdn.shopify.com/s/files/1/0430/9028/0609/files/besebotoreletovobofixeri.pdf
    • https://cdn.shopify.com/s/files/1/0432/8243/2160/files/company_profile_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009574.bin
d4df8a880b825c76c9b4317e3fc1a59fac0547fd0e9a240993aaad85c804a124		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9574 5332 bytes
font_01_sfnt_off0000a7aa.bin
790a0e84ec85aff319acc4d9a06f1dfde8bb91ef417cdbd0d94847d569a45e06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA7AA 11128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.