Malicious PDF — malware analysis report

Static analysis result for SHA-256 53148623e8a1103e…

MALICIOUS

PDF

48.1 KB Created: 2020-07-22 06:52:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6714846870078f027ce20793bbaea9be SHA-1: 00b648f6a6226268068fdda976718738a2d7b406 SHA-256: 53148623e8a1103ea6a88b234c51f8f61bbd2efd9444b161f47f65e653e66360
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a large number of embedded links, with one pointing to a known malicious redirector. The document body, though heavily obfuscated, appears to be a lure related to surgical equipment manuals. The primary attack vector is likely a user being tricked into clicking the malicious link within the PDF, leading to the redirector.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=stealthstation%20s7%20surgical%20navigation%20system%20manual
    • http://files.ginconferencegindc.org/uploads/1/3/2/6/132681210/6518339.pdf
    • http://files.nittennair.com/uploads/1/3/1/6/131636562/pajefowanomawu-dakikitu-telarevoweg.pdf
    • http://files.commiefaggots.com/uploads/1/3/2/7/132740804/saxelapolox-razefasavaza-gijazapezag.pdf
    • http://files.mlmedicalsupplies.com/uploads/1/3/1/3/131384286/8693757.pdf
    • http://files.cdastudio.org/uploads/1/3/0/7/130739076/fuzomis-xunemipani.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/surorut.pdf
    • https://cdn.shopify.com/s/files/1/0437/1218/4474/files/lobosepadaziwulutikibezu.pdf
    • https://cdn.shopify.com/s/files/1/0428/0093/9164/files/xonefevaposapiwemewoxux.pdf
    • https://woxujobeza.files.wordpress.com/2020/07/kubarapasavavatarepiz.pdf
    • https://mutemoxapeko.files.wordpress.com/2020/07/3819347980.pdf
    • https://vekokipevi722356982.files.wordpress.com/2020/06/zujudodilerosasosokenus.pdf
    • https://cdn.shopify.com/s/files/1/0432/6971/8176/files/1841102581.pdf
    • https://cdn.shopify.com/s/files/1/0433/6464/7077/files/85056963637.pdf
    • https://cdn.shopify.com/s/files/1/0430/0396/9689/files/rifefibalazi.pdf
    • https://cdn.shopify.com/s/files/1/0427/4189/1238/files/saxatorovubuvoniremesiwa.pdf
    • https://cdn.shopify.com/s/files/1/0436/7102/7865/files/xubiwapikosudibor.pdf
    • https://cdn.shopify.com/s/files/1/0433/1631/4277/files/97272949525.pdf
    • https://cdn.shopify.com/s/files/1/0431/1141/5962/files/rupinatojilugenom.pdf
    • https://cdn.shopify.com/s/files/1/0437/7565/6094/files/54306318844.pdf
    • https://cdn.shopify.com/s/files/1/0433/8070/3399/files/27969593030.pdf
    • https://cdn.shopify.com/s/files/1/0429/9581/0455/files/75456324313.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007aaf.bin
85caf45850e2d4ed0f63270d1221b8d0411a1edc6bdcd00cfdc74debd484ac72
pdf-font-stream PDF embedded font (sfnt) at offset 0x7AAF 5440 bytes
font_01_sfnt_off00008d05.bin
311838f3b6c0bed5a1012ed6a17bb52d3b171b1961d449128d62325064ed67d3
pdf-font-stream PDF embedded font (sfnt) at offset 0x8D05 10948 bytes