Malicious PDF — malware analysis report

Static analysis result for SHA-256 5136b95ce9c64ae6…

MALICIOUS

PDF

45.2 KB Created: 2020-09-18 02:06:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3d0a8212504bc45138164bbd5d96d4d0 SHA-1: bdef6b859a2591f16bbfc257b0d9216e8b0c8d79 SHA-256: 5136b95ce9c64ae6b34f30b11815e0b8d85cc9dcf5140e469767946a1d5e680c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to external sites designed to host further malicious content. The document body, though partially corrupted, suggests a lure related to 'coloring workbook answers anatomy and physiology' to entice users to click the malicious links. The primary malicious link identified is https://ttraff.me/wix?keyword=coloring+workbook+answers+anatomy+and+physiology, which likely leads to further redirection or malware delivery.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=coloring+workbook+answers+anatomy+and+physiology
    • http://refajilo.houseofgeekiness.com/uploads/1/3/2/3/132303382/963fa.pdf
    • http://files.meaganedgar.com/uploads/1/3/1/6/131606094/02ea19cf3.pdf
    • http://files.geophysical.eu/uploads/1/3/2/6/132682681/godatugojuj.pdf
    • http://nudibojeg.ardingtonschoolofcrafts.com/uploads/1/3/0/7/130776889/4578245.pdf
    • http://rokoker.railoun.com/uploads/1/3/2/6/132681946/2564840.pdf
    • https://cdn.shopify.com/s/files/1/0432/2168/0283/files/elatus_era_safety_data_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0430/7383/1072/files/wedumariwalarivum.pdf
    • https://cdn.shopify.com/s/files/1/0434/0734/3772/files/movixobabepofejukezoza.pdf
    • https://cdn.shopify.com/s/files/1/0454/3751/7982/files/dafutisowopixuxuzevupowir.pdf
    • https://cdn.shopify.com/s/files/1/0428/5153/2963/files/haryana_police_annexure_e1_form.pdf
    • https://cdn.shopify.com/s/files/1/0432/4104/6171/files/30043394949.pdf
    • https://cdn.shopify.com/s/files/1/0427/6636/8935/files/muguzasovile.pdf
    • https://cdn.shopify.com/s/files/1/0434/5259/6374/files/tesujidak.pdf
    • https://e7ad12dc-90e7-42cc-a0f3-5852ad193cf3.filesusr.com/ugd/7a13df_ee4be3df8642429d9464d47bd9a6d9e0.pdf?index=true
    • https://a9e2ccfa-4f61-4692-bb3b-4de6a9b6b681.filesusr.com/ugd/d17951_19b704671c5d415c812b9fea53e780f6.pdf?index=true
    • https://475ba9ae-2147-437b-8745-a49489be4a80.filesusr.com/ugd/7d1dc9_78a8431a10fe45ab82d9f27dfe7263f0.pdf?index=true
    • https://6bb88ffd-12d0-430a-8bcf-316d4a49f299.filesusr.com/ugd/17beed_d8a1f15de5a14142b20db3810d3a770f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007153.bin
aadb33beab8275a6b445a06d4bc408e62cb3dbfac7e715d073dd26e27ddc8aeb
pdf-font-stream PDF embedded font (sfnt) at offset 0x7153 5676 bytes
font_01_sfnt_off00008484.bin
805af654105872be2e5f97ece7a37e6e835bc5792558ec4d7b3ae8901ff98804
pdf-font-stream PDF embedded font (sfnt) at offset 0x8484 10312 bytes