Malicious PDF — malware analysis report

Static analysis result for SHA-256 839f0d8c927aecb7…

MALICIOUS

PDF

191.4 KB Created: 2020-08-11 12:11:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b1aa61810d43b49036672995c3a2729 SHA-1: 2ffa061e86976d3cc90a0daa32fe25eb52f7aac7 SHA-256: 839f0d8c927aecb7e77c8847da1fdc64d0db8b6b4efbf133b1b8fd33f8f314ee
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.cc/pify?keyword=bose+qc20i+manual+pdf'. The document body, though heavily obfuscated, also contains this URL, suggesting the document's purpose is to trick the user into visiting this malicious site, likely for a phishing or malware distribution scheme. No scripts were extracted from this sample.

Heuristics 2

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=bose+qc20i+manual+pdf
    • http://poxopet.hkminimefencing.com/uploads/1/3/1/4/131408738/vezixefe.pdf
    • http://sikotif.stpaulslewisburg.org/uploads/1/3/1/6/131606289/fuluvovu.pdf
    • http://files.comiccutdown.com/uploads/1/3/2/6/132681690/2fbb9.pdf
    • http://files.pixelsandpedagogy.com/uploads/1/3/0/7/130739140/6112453.pdf
    • https://cdn.shopify.com/s/files/1/0431/6368/0932/files/864773341.pdf
    • https://cdn.shopify.com/s/files/1/0434/6504/8229/files/sapugexekojifoke.pdf
    • https://cdn.shopify.com/s/files/1/0430/9634/2695/files/kurupegij.pdf
    • https://cdn.shopify.com/s/files/1/0431/5296/5792/files/lala_ramswaroop_calendar_2020_file_download_free.pdf
    • https://cdn.shopify.com/s/files/1/0432/6467/1909/files/brche_dezimalbrche_prozente_bungen.pdf
    • https://cdn.shopify.com/s/files/1/0436/1804/2018/files/22669612113.pdf
    • https://cdn.shopify.com/s/files/1/0430/0242/9593/files/nijuwimenalozexa.pdf
    • https://cdn.shopify.com/s/files/1/0437/6412/1752/files/panojemebemozupunifatiwu.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/94608223162.pdf
    • https://cdn.shopify.com/s/files/1/0430/6360/7445/files/96602362463.pdf
    • https://cdn.shopify.com/s/files/1/0434/3375/4773/files/2006_honda_pilot_repair_manual.pdf
    • https://cdn.shopify.com/s/files/1/0434/6337/7048/files/buvulixadenegukeduzi.pdf
    • https://cdn.shopify.com/s/files/1/0428/5366/2883/files/agua_de_beber_bb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0001b83d.bin
7979dc75b1214d7ec0be580e7441a6ab724e2956af412553bf462b693d6a9bca		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B83D 6128 bytes
font_01_sfnt_off0001cce9.bin
405f4940224dc75dbab30ee69f1c2163313612c526330bcacaf07e8601290017		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CCE9 2160 bytes
font_02_sfnt_off0001d6a0.bin
5e88c3c7390e4216ce451f306a240e97d940876ec50204725a35e440e6cbb62c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D6A0 5456 bytes
font_03_sfnt_off0001e912.bin
4e00afdf6d3e41a1db72a75646c1604da41e42acac2c3998fe28049e7982d939		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E912 23596 bytes
font_04_sfnt_off00021067.bin
7f74874d22d38989e2b0b7eb502272975d989ccd4d011339ecffb042a0b511ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21067 8328 bytes
font_05_sfnt_off00022f62.bin
5cb73a1cf22f4296b9b1f56487e78e1ce94ce2af12b52dde6f95a11810dcc8ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22F62 13980 bytes
font_06_sfnt_off00025ae1.bin
a38da5e7fc4eaf2269d11811482b81ae5a7261927e0b2ff39eada06945262c8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25AE1 47776 bytes
font_07_sfnt_off0002c960.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C960 16204 bytes
font_08_sfnt_off0002de8e.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DE8E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.