Malicious PDF — malware analysis report

Static analysis result for SHA-256 86a64b0fc71d77df…

MALICIOUS

PDF

84.4 KB Created: 2020-08-31 04:39:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 576c4549d6aceb97abcc401273c6155f SHA-1: 71f8feed99a87d9c921efaa9c34a5dd49f28ad1a SHA-256: 86a64b0fc71d77df93985c126814b271f9ff19c81c87f62a1513f4338af6ca66
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a malicious URL, disguised as a Christmas carols PDF. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms this behavior. The PDF also contains a large number of external links, as indicated by PDF_SEO_LINK_FARM, suggesting a link farm or SEO poisoning tactic. The embedded URL points to a redirector, which is a common technique for delivering malware or phishing pages.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=christmas+carols+pdf
    • https://cdn.shopify.com/s/files/1/0433/3341/9160/files/tipuxunulopigav.pdf
    • https://cdn.shopify.com/s/files/1/0431/1043/2929/files/wrong_turn_4_movie.pdf
    • https://cdn.shopify.com/s/files/1/0437/0199/3622/files/22166013652.pdf
    • https://static.usrfiles.com/ugd/b8c837_c6158310df2f4a8096c6c1d960caf0ed.pdf
    • https://static.usrfiles.com/ugd/08fe48_14495366981d4cb2914ce29d6223d9b8.pdf
    • https://static.usrfiles.com/ugd/c63dba_cd6027e4cbf649f2b2c8bc639e5faca3.pdf
    • https://static.usrfiles.com/ugd/516793_d8625c7f60f044198492070962b0fade.pdf
    • https://static.usrfiles.com/ugd/c0b427_8251016a81704f0db3d83180fc3c91ba.pdf
    • https://static.usrfiles.com/ugd/e73fea_8da3538e6a4249b788c2e3c78ae38e71.pdf
    • https://static.usrfiles.com/ugd/b8c837_0855aecdad9f4b0aa0a1147d93c609aa.pdf
    • https://static.usrfiles.com/ugd/37428b_1d2f832513294b5d858875e28ad5c1b0.pdf
    • https://static.usrfiles.com/ugd/804ff6_5ffbd4cb22d647178413ba72a83f7be1.pdf
    • https://static.usrfiles.com/ugd/b8c837_66def0301fec4b8982a9bcd60fb46537.pdf
    • https://static.usrfiles.com/ugd/c1de29_2d4c6a6fc30642038ad390e00e0b0ef6.pdf
    • https://static.usrfiles.com/ugd/b8c837_12fb960ee9454235a05b14f08c78ec41.pdf
    • https://static.usrfiles.com/ugd/b7082a_33666908405b4ed7a0a6d346c4fc8831.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010229.bin
61fc9b85f64090b8c36c666f9e176a75ea3810d5b62483f7608d6a96058112ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10229 5300 bytes
font_01_sfnt_off00011401.bin
42628992963990ca1b351a4ea5a34a7337986ea45f3ef7c3a2567550dcf92022		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11401 16220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.