Malicious PDF — malware analysis report

Static analysis result for SHA-256 573589bdf3b8ecf4…

MALICIOUS

PDF

43.3 KB Created: 2020-09-09 19:13:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 968fce06d7e319b7cfacf1a03c84c452 SHA-1: 255c507f6d4e34ef0ad76b5df4b71202d46f6732 SHA-256: 573589bdf3b8ecf4ca46f54e5521b2a1f83d7d4e50c705bc379d9feb7ed45758
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, masquerading as a "normal distribution cheat sheet pdf" to entice users. One of the embedded URLs, https://ttraff.me/pify?keyword=normal+distribution+cheat+sheet+pdf, is identified as a malicious redirector. The file's structure and numerous links suggest a link farm or phishing lure designed to redirect users to potentially harmful content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=normal+distribution+cheat+sheet+pdf
    • http://guleni.tayloron.net/uploads/1/3/2/3/132303382/pebimigijuxeji.pdf
    • http://files.doublefarley.com/uploads/1/3/1/0/131069978/01ca8073aa3.pdf
    • http://files.vikalpbengaluru.org/uploads/1/3/1/1/131163740/luxuzelukup.pdf
    • http://vezesi.helpinghandsrescue.org/uploads/1/3/2/8/132815806/dizaku_webeto_dimokekipune_tones.pdf
    • http://silefe.jihyunhong.com/uploads/1/3/0/8/130814687/zizeginomuxavegi.pdf
    • http://files.burningswordsmenstudio.com/uploads/1/3/2/8/132814342/8344aecca3.pdf
    • http://files.kcbeast.com/uploads/1/3/2/7/132712015/zeteroxoxi.pdf
    • http://fasakav.pomolas.com/uploads/1/3/1/4/131408159/lesibewumu_takalusof.pdf
    • http://vuxopad.medtechwearables.com/uploads/1/3/1/3/131379730/7769098.pdf
    • http://files.fatalcrimeconfessions.com/uploads/1/3/1/0/131069934/sibuti_jurelona_rizilujefuxevo.pdf
    • https://static.usrfiles.com/ugd/1813b3_a0cb4170d7b7435b8321c06c3cd36b3f.pdf
    • https://static.usrfiles.com/ugd/b8c837_c9970b5da675482bb4c053a541134968.pdf
    • https://static.usrfiles.com/ugd/957c7b_d49413f2fbe7491cbfc583b9e66de9cd.pdf
    • https://static.usrfiles.com/ugd/0bfb20_f3e3c8db26fd4057b87a40f8f42e3ddf.pdf
    • https://static.usrfiles.com/ugd/b8c837_1ec6f597d2ff4540901f944626f031eb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f48.bin
19859f11ad60e09c13574b474a50906bdeace5cb62f471dc9d5b83b020e208ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F48 5504 bytes
font_01_sfnt_off000071d2.bin
958931cac1c4948da2c1afabc3c73b76a11aa4c331c0c6e202b7cd873b1e2fad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71D2 14968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.