Malicious PDF — malware analysis report

Static analysis result for SHA-256 57e796414c9f09fd…

MALICIOUS

PDF

156.9 KB Created: 2020-08-21 16:30:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca8fa166d8958c178a99c0e54876d232 SHA-1: ab7a48546c27bc8af8fef25b81b69e8f3a705d96 SHA-256: 57e796414c9f09fd6d8185ad2c55b9c209ec9d4e9f1bb5898821e08a9ae8a10b
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.cc/pify?keyword=chemistry+form+3+notes+free'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary mechanism for luring the user. The presence of urgency and download button lures further supports the attack pattern of social engineering to entice users to click the malicious link. No scripts were extracted from this sample.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=chemistry+form+3+notes+free
    • http://rejapusab.watercolorpaintingsbymarkmellor.com/uploads/1/3/0/7/130775795/dd79a54b.pdf
    • http://files.babyg-lash.com/uploads/1/3/1/3/131380390/duvobiderosofa-xekupi-rexuramod.pdf
    • http://files.sweetdreamsthykingdomcome.com/uploads/1/3/0/7/130775205/bupuko_lomuzekep_liwigusuleri.pdf
    • http://files.grignonmansion.org/uploads/1/3/0/7/130740163/dazaxunumofegijaxoxa.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/12909571685.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gerakofidasetivivirodipel.pdf
    • https://cdn.shopify.com/s/files/1/0431/9644/8917/files/25266864914.pdf
    • https://cdn.shopify.com/s/files/1/0428/2338/5247/files/47899856351.pdf
    • https://cdn.shopify.com/s/files/1/0435/2750/4024/files/breathing_exercise_books.pdf
    • https://cdn.shopify.com/s/files/1/0432/9262/2998/files/fuzubijupuzopelelo.pdf
    • https://cdn.shopify.com/s/files/1/0433/4364/2792/files/wexitizibojofuku.pdf
    • https://cdn.shopify.com/s/files/1/0432/7142/2115/files/83302456351.pdf
    • https://cdn.shopify.com/s/files/1/0431/5247/4267/files/35015725781.pdf
    • https://cdn.shopify.com/s/files/1/0433/6841/5400/files/76989748447.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021937.bin
1b1b74bd9ee5cbd0f4bc1ac74256b32097e5c4d26b0a5ed18058380892e57607
pdf-font-stream PDF embedded font (sfnt) at offset 0x21937 4936 bytes
font_01_sfnt_off000229eb.bin
c63ba9674514271ee99edb525675d8382ab5a43ec8fb63f606861cf523a82c78
pdf-font-stream PDF embedded font (sfnt) at offset 0x229EB 11304 bytes
font_02_sfnt_off00025075.bin
fab317daee41ac4da8f39c339df38c2912d3b1987b89b6b213fbac20b8db8190
pdf-font-stream PDF embedded font (sfnt) at offset 0x25075 16248 bytes