Malicious PDF — malware analysis report

Static analysis result for SHA-256 55165b7258abf2e0…

MALICIOUS

PDF

59.3 KB Created: 2020-09-02 05:16:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 836acff6039c4c9e105e94881b009a92 SHA-1: 3891233f32628e83089997d2550ae99661a9b21f SHA-256: 55165b7258abf2e0cfe54c336ec0e7c5d893da0047ba0115ea6bf8437c85c1cf
148 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains multiple embedded links, with one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text fragments and URLs that suggest a lure related to 'Capitec online app', aligning with invoice or callback phishing tactics. The presence of a link farm further indicates an attempt to distribute malicious content or phishing pages.

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=capitec+online+app
    • https://static.usrfiles.com/ugd/3f0e57_fff84c2d6e074387a9e592d163ea7639.pdf
    • https://static.usrfiles.com/ugd/510a18_ecc2f0ef5f3546c8afa5ba27c76e5a3b.pdf
    • https://static.usrfiles.com/ugd/b48b60_50e81a025d15469ab780d3a8687a5c25.pdf
    • https://static.usrfiles.com/ugd/0dcf4b_1ac8df29d9ba49a89023710484fd5094.pdf
    • https://static.usrfiles.com/ugd/b8c837_b89d1339c7be4540bef989657ddeba12.pdf
    • https://static.usrfiles.com/ugd/4d400c_7e9c4dd087744195a86a3aa9f4107913.pdf
    • https://cdn.shopify.com/s/files/1/0432/1175/1579/files/bacterial_pathogenesis_book.pdf
    • https://cdn.shopify.com/s/files/1/0451/2677/9034/files/convert_to_word_file_using_java.pdf
    • https://cdn.shopify.com/s/files/1/0432/2800/4507/files/linear_and_rotary_actuators.pdf
    • https://cdn.shopify.com/s/files/1/0431/6105/9477/files/kininodidezawezepi.pdf
    • https://static.usrfiles.com/ugd/eb4c03_0a8b2f745b4349908d6e302e8c386b1d.pdf
    • https://static.usrfiles.com/ugd/0c41e7_b428726a6b5340b9b5764011b2cbea6a.pdf
    • https://static.usrfiles.com/ugd/36f25b_1938b8c9ac5f471b9b1b2924091addc6.pdf
    • https://static.usrfiles.com/ugd/55e2c6_d043563293fd4a64ac4d893695814f23.pdf
    • https://static.usrfiles.com/ugd/b8c837_9badf7fb0ffd40e79498412c81767ac0.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a46.bin
b7f317aa0f29cd34df008dc84d8f376d2685882a57a4a5cd0d86477d0adf885a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A46 2828 bytes
font_01_sfnt_off00008441.bin
c5fc0afc73e5b37cbd989dcbae00bd060bed6e1eeaeadfe07fb7a56815d12097		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8441 4556 bytes
font_02_sfnt_off000093cb.bin
55510a8b0bdc056bb27ed06d2dd10afdeb981a6b6aeef61f903d9c5cc337db82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93CB 8336 bytes
font_03_sfnt_off0000a56d.bin
984d0a2df2ae781aee1a6fc7a043410f5b6e1ad6f138cd80a9faeda948ee92cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA56D 10216 bytes
font_04_sfnt_off0000c8a0.bin
38ff3b51e8b7a9b70b868413958362dd30b9bafd15a96a851669cccbfa654d58		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8A0 16620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.