Malicious PDF — malware analysis report

Static analysis result for SHA-256 87be8196b210f813…

MALICIOUS

PDF

39.3 KB Created: 2020-08-19 21:57:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50934044f4db951ea3bbb8fade13ce73 SHA-1: 932a71c3cd644788bfe3f58c93c404f781c4142e SHA-256: 87be8196b210f813dbf183340e724be8cd3cabd2cad34976b5ff122241ef8b05
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains numerous embedded links, with a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK pointing to ttraff.cc. The document body, though heavily obfuscated, contains the string 'Verithanam video song mp4' and the malicious URL, suggesting a lure for users to download content. The PDF_SEO_LINK_FARM heuristic indicates a large number of links, likely for SEO manipulation or to host further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=verithanam+video+song++mp4
    • http://files.tristatemaxedoutwomenspac.org/uploads/1/3/1/3/131382395/vajewoj_wapeka.pdf
    • http://madadop.discoverdiving.im/uploads/1/3/1/6/131636644/83212e0f.pdf
    • http://files.4waccessories.com/uploads/1/3/0/7/130740573/6253939.pdf
    • https://cdn.shopify.com/s/files/1/0429/5743/9129/files/64865130043.pdf
    • https://cdn.shopify.com/s/files/1/0434/7016/0032/files/42114742485.pdf
    • https://cdn.shopify.com/s/files/1/0451/4473/5909/files/caballo_de_troya_2_masada_1986.pdf
    • https://cdn.shopify.com/s/files/1/0437/1932/7896/files/1847294989.pdf
    • https://cdn.shopify.com/s/files/1/0429/9476/1877/files/rowudojemarepidelibete.pdf
    • https://cdn.shopify.com/s/files/1/0437/7142/9016/files/movovi.pdf
    • https://cdn.shopify.com/s/files/1/0435/9743/0941/files/861083774.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003eb9.bin
392c271cd80788b7d15b6e4ece2f22912d3ce47a3c1d18a545511d2baa18bea6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EB9 5456 bytes
font_01_sfnt_off0000511b.bin
fa98316bad0ee393e4244be63b1d230beb4724cf855be96ad4f2c87a5b302ae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x511B 2140 bytes
font_02_sfnt_off00005af4.bin
a8f66b9549de37184bc5594d832f8d3f81ffe6402a22e91f39d67ff6d3c77c8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AF4 9096 bytes
font_03_sfnt_off00007a3e.bin
8fe31ac2096c5e11ca20e474ac9d4b0e624cd7c6a3d6648e58269b78a2b36287		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A3E 16304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.