Malicious PDF — malware analysis report

Static analysis result for SHA-256 78c49a75f624b795…

MALICIOUS

PDF

49.5 KB Created: 2020-08-30 21:45:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4c04a0862b037748b74475d76f352e6d SHA-1: 68bdd47b6c899d0849be11712be88957119ad531 SHA-256: 78c49a75f624b79558ca7efbdc13c0c768b8d4a34fe612a9baa1c7950f5cca8a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous external links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to "Bikram yoga book" and the wkhtmltopdf tool, suggesting a lure. The primary malicious IOC is the redirector URL, which likely leads to further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=bikram+yoga+book
    • https://static.usrfiles.com/ugd/df4650_d0ca8978990e484ebaa361a148ab9c8f.pdf
    • https://static.usrfiles.com/ugd/b8c837_4d839e889e1743e389a3da0ab895b5a3.pdf
    • https://static.usrfiles.com/ugd/2f7815_379ece6034e94da9829707187c0ad86d.pdf
    • https://static.usrfiles.com/ugd/b8c837_0dcf7ec2b9304b93a502b2df4ea6278d.pdf
    • https://static.usrfiles.com/ugd/b8c837_854ccda3cc304d0586db2b2da9a270c3.pdf
    • https://static.usrfiles.com/ugd/33a2e4_85b9239838de45e3a40a79a9faa180bc.pdf
    • https://static.usrfiles.com/ugd/9cc572_6d2e29118f574c5a8291437ccebdc068.pdf
    • https://static.usrfiles.com/ugd/b8c837_d27470ce9b60460db4db6588a0ddc319.pdf
    • https://static.usrfiles.com/ugd/e7e4a0_848a47ef2eb24fb88199b0526d61c07f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069c7.bin
abab51f4e0d43fbff9f7c4b4a8324a478afeec57e4619fea63f816113df7fa90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69C7 4636 bytes
font_01_sfnt_off00007981.bin
0cd3e0dfc1bcc538de73a9303779f8f7127af0a724aab2a03a0813100fbeb6eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7981 16096 bytes
font_02_sfnt_off0000abca.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xABCA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.