Malicious PDF — malware analysis report

Static analysis result for SHA-256 53eefb1d3141d063…

MALICIOUS

PDF

44.2 KB Created: 2020-07-27 22:14:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 83129d7fea24df21a74aa2dd12fbd4a7 SHA-1: 08dd16be20816aafe214fac3f315af2f7599088a SHA-256: 53eefb1d3141d0633532efa7e0fa5dbc28f192557f64b905162fe472cee27b4c
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1566 Phishing

The PDF contains embedded JavaScript and a critical heuristic firing for a malicious redirector link. This link, 'https://ttraff.cc/pify?keyword=1-+99+construction+guide+rs3+2018', likely serves as the initial lure to redirect the user to a malicious destination. The presence of numerous other PDF links, many pointing to potentially untrusted file hosting services, further supports the attack pattern of distributing malicious content or conducting phishing. No specific malware family could be identified.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=1-+99+construction+guide+rs3+2018
    • http://files.roamingbuffalo.us/uploads/1/3/2/6/132682930/9255871.pdf
    • http://files.critical-juncture.net/uploads/1/3/1/3/131383649/bobasakijapox.pdf
    • http://files.thecuriouscatgiftshop.com/uploads/1/3/2/6/132681596/puwakir.pdf
    • http://files.soignecalligraphy.com/uploads/1/3/0/7/130775373/502c834205e6.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/43778875991.pdf
    • https://cdn.shopify.com/s/files/1/0431/3759/7607/files/10461603422.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xeniwepisovera.pdf
    • https://cdn.shopify.com/s/files/1/0437/7742/5565/files/torisezojad.pdf
    • https://cdn.shopify.com/s/files/1/0432/5851/1510/files/3716935610.pdf
    • https://cdn.shopify.com/s/files/1/0436/9124/5733/files/66838539677.pdf
    • https://cdn.shopify.com/s/files/1/0434/4253/6604/files/fekewafekezurib.pdf
    • https://cdn.shopify.com/s/files/1/0427/8845/4559/files/35206639428.pdf
    • https://cdn.shopify.com/s/files/1/0440/3943/8486/files/38937414609.pdf
    • https://cdn.shopify.com/s/files/1/0435/4595/2408/files/zobesikapa.pdf
    • https://cdn.shopify.com/s/files/1/0431/6237/0210/files/67832913242.pdf
    • https://cdn.shopify.com/s/files/1/0432/5857/7046/files/33510144455.pdf
    • https://cdn.shopify.com/s/files/1/0429/2483/4975/files/rukiviga.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f1c.bin
f5af14d19640f59fea41480f31f364574c3c027393c8bca255f085c4d7413359
pdf-font-stream PDF embedded font (sfnt) at offset 0x6F1C 5524 bytes
font_01_sfnt_off000081e2.bin
88d986a1702339da658fb3ebd54c033f3de89827991c39dfb7da4be4593aea60
pdf-font-stream PDF embedded font (sfnt) at offset 0x81E2 9876 bytes