Malicious PDF — malware analysis report

Static analysis result for SHA-256 57dce8b007309fd7…

MALICIOUS

PDF

33.8 KB Created: 2020-06-03 23:56:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44d4880d6184aead40247d1025650982 SHA-1: c5cdecb2f125f54a84b4f17c7ed21f23d325355b SHA-256: 57dce8b007309fd7d387f80f5501182a2130796ccff3d47f8ab414b74f6fac23
220 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF contains a direct link to an executable file disguised as a converter tool, indicating a social engineering lure to trick users into downloading malware. The document also features a large number of links to other PDF files hosted on various domains, suggesting a link farm for SEO poisoning or to distribute further malicious content. The presence of PDF_ACTION_PARSER_EVASION indicates attempts to evade detection.

Heuristics 5

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wp3?keyword=converter+pdf+to+word.exe#converter+pdf+to+word.exe
    • http://amethystvisions.com/uploads/1/3/0/4/130435787/bd6574210.pdf
    • http://sistemasfta.com/uploads/1/3/0/4/130483447/3b70ddbe12.pdf
    • http://normancbuildingco.com/uploads/1/3/1/0/131070490/7286267.pdf
    • http://mousai.art/uploads/1/3/0/6/130639926/8938724.pdf
    • http://montanafowlerart.com/uploads/1/3/0/6/130621576/toluzu-pibesoz.pdf
    • http://healthywaysdietnutrition.com/uploads/1/3/1/4/131452837/151046.pdf
    • http://growinglegacymovie.org/uploads/1/3/1/3/131380786/vodopetunosamafeje.pdf
    • http://theworstofdonaldtrump.com/uploads/1/3/0/6/130639672/pimap_favobifosusizo_bazetowe.pdf
    • http://beatsbytheharv.com/uploads/1/3/0/7/130739963/3139268.pdf
    • https://tuvuxexe.files.wordpress.com/2020/06/71124806081.pdf
    • https://rugubijewe.files.wordpress.com/2020/06/88832094288.pdf
    • https://relexuxiwa.files.wordpress.com/2020/06/57405241398.pdf
    • https://dajejunej.files.wordpress.com/2020/06/visuxipezexok.pdf
    • https://kubuwenix.files.wordpress.com/2020/06/61743514090.pdf
    • https://lonewer.files.wordpress.com/2020/06/48347163223.pdf
    • https://kuzelelete.files.wordpress.com/2020/06/34525467587.pdf
    • https://wordpress.com/tos/
    • https://wordpress.com/dmca.html
    • https://wordpress.com/policy.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005727.bin
d3639942683b8aab2197acb8e824ee400cdb1ce366f77b1a0c41964eb404126c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5727 10612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.