Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fb3c6eeb632a75e…

MALICIOUS

PDF

36.2 KB Created: 2020-08-14 18:20:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76d263570edd2b9d6d51f8edf1547b96 SHA-1: 6e28b0d8fdce454dcd3d154635ff83d8eb5a86e3 SHA-256: 7fb3c6eeb632a75ed94595d7a55c7eb0be80d2f3355a22ca9e41c52d30a94a71
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique often used in SEO link farms to manipulate search engine rankings or distribute malicious content. One of these links, 'https://ttraff.cc/pify?keyword=badder+than+most', is identified as a known malicious redirector. The document body itself is heavily obfuscated and contains a mix of text and URLs, further suggesting a malicious intent to lure users to harmful sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=badder+than+most
    • http://benuveve.andreanelson.studio/uploads/1/3/1/1/131164128/turajoturowov_fezuvesusanabaj_lelobafobixasod.pdf
    • http://files.ahimsaveganliving.com/uploads/1/3/0/7/130739287/neraga-poxatizidit.pdf
    • http://mumivem.bluemountainsafricanvioletsaus.com/uploads/1/3/1/4/131437987/xeboletudasoz.pdf
    • http://files.amselectric.com/uploads/1/3/1/3/131378993/6639515.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/40323832667.pdf
    • https://cdn.shopify.com/s/files/1/0435/3720/3364/files/spartan_mountain_master_chassis_manual.pdf
    • https://cdn.shopify.com/s/files/1/0429/3964/6108/files/lepima.pdf
    • https://cdn.shopify.com/s/files/1/0431/0138/8953/files/53592783055.pdf
    • https://cdn.shopify.com/s/files/1/0432/5788/8932/files/honda_eu2000i_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/4927/1975/files/70574747393.pdf
    • https://cdn.shopify.com/s/files/1/0431/8697/8984/files/luvalofevalikab.pdf
    • https://cdn.shopify.com/s/files/1/0428/5769/3347/files/42081211092.pdf
    • https://cdn.shopify.com/s/files/1/0427/8370/3206/files/65137287446.pdf
    • https://cdn.shopify.com/s/files/1/0437/5071/9642/files/bebuvomafipuzopulivi.pdf
    • https://cdn.shopify.com/s/files/1/0439/8841/8718/files/lezikoterusuwekubusivelis.pdf
    • https://cdn.shopify.com/s/files/1/0428/6559/0438/files/keparobak.pdf
    • https://cdn.shopify.com/s/files/1/0433/5108/1114/files/wajuwanetevunofedul.pdf
    • https://cdn.shopify.com/s/files/1/0430/5141/7751/files/20867052295.pdf
    • https://cdn.shopify.com/s/files/1/0427/6230/5702/files/xoxalapatovaturufavufe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000507c.bin
cdf995c1e7c9b4638d7e545850f42670c68c91c127534ead5fb08da61b371d0e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x507C 5084 bytes
font_01_sfnt_off0000618d.bin
37e99ab2d67a6831ac2020b85f0056a87ac954e98ccda82deb9b09b2ca4c365e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x618D 10104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.