Malicious PDF — malware analysis report

Static analysis result for SHA-256 7914ef28ea290e57…

MALICIOUS

PDF

12.4 KB Created: 2020-07-09 04:49:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57a75e5b66cae4e8a0508a1570a10e0e SHA-1: 58175f616195b7692bf240c22e12d7d6ab5c353e SHA-256: 7914ef28ea290e571d0689abdd570e67dea9eb730de2320155cb1d0d5ae5497c
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

This PDF document is designed as a lure, presenting itself as a free download but containing only an image and a malicious link. The primary link redirects through ttraff.ru, a known malicious redirector, to a series of other PDF files hosted on various domains. This indicates a phishing or content-spamming campaign aiming to drive traffic to potentially malicious sites or distribute further malware.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 12 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=free%20download%20quran%20with%20english%20translation%20pdf
    • http://files.merrifieldseminar.com/uploads/1/3/2/7/132710655/7749287.pdf
    • http://files.srrlsf.com/uploads/1/3/1/3/131380868/4f04903295aa5.pdf
    • http://files.nashvilleucc.org/uploads/1/3/2/3/132303020/duwubazonisapexomuf.pdf
    • http://files.thebrowniecottage.com/uploads/1/3/1/8/131871909/zuvakexukamufokileja.pdf
    • http://files.exmouthcaninecentre.co.uk/uploads/1/3/0/8/130874128/jenasaj.pdf
    • http://files.rockingcleatherandboutique.com/uploads/1/3/1/3/131383510/7375545.pdf
    • http://files.mapleafdals.com/uploads/1/3/1/6/131606284/powusibewirini.pdf
    • http://files.divinesoulenergy.com/uploads/1/3/0/9/130969819/d55ccdadbe3c.pdf
    • http://files.powerofmath.net/uploads/1/3/1/4/131454172/5715147.pdf
    • https://lugopago.files.wordpress.com/2020/06/xenedewepadafosu.pdf
    • https://fijupuw.files.wordpress.com/2020/07/pewiriridekope.pdf
    • https://digigiwel.files.wordpress.com/2020/07/wipawejosodovulivome.pdf
    • https://kufexetironi.files.wordpress.com/2020/07/judarivodok.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.