Malicious PDF — malware analysis report

Static analysis result for SHA-256 87db267a1bdcb76a…

MALICIOUS

PDF

54.9 KB Created: 2020-09-01 02:47:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 213a8b2cbfa25b2cdc1d36432c59bcd7 SHA-1: cd260bdc9298788f3a4afb4ec917d8eeb747b34d SHA-256: 87db267a1bdcb76aa26027f452e9202e1d7e31cbca21a25e208c7c7ed8ad4b45
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with one pointing to a known malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting an attempt to create a link farm or distribute malicious content. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further supports a lure-based attack. The document body contains the malicious URL and several benign-looking Shopify URLs, likely part of the link farm.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=adzan+merdu+madinah
    • https://cdn.shopify.com/s/files/1/0427/9150/1990/files/nejixokasanimagoloralafot.pdf
    • https://cdn.shopify.com/s/files/1/0432/4435/5739/files/pudowi.pdf
    • https://cdn.shopify.com/s/files/1/0440/9671/6952/files/47709049849.pdf
    • https://cdn.shopify.com/s/files/1/0431/8845/3533/files/manakitezukulifuxiso.pdf
    • https://cdn.shopify.com/s/files/1/0432/2135/2606/files/d_d_3._5e_player_s_handbook.pdf
    • https://cdn.shopify.com/s/files/1/0433/4141/4552/files/notebedatinekuvo.pdf
    • https://cdn.shopify.com/s/files/1/0431/8111/3506/files/coded_with_love.pdf
    • https://cdn.shopify.com/s/files/1/0429/5124/5987/files/17915476787.pdf
    • https://cdn.shopify.com/s/files/1/0428/6591/8118/files/fowapadi.pdf
    • https://cdn.shopify.com/s/files/1/0429/7247/9647/files/64924519337.pdf
    • https://cdn.shopify.com/s/files/1/0460/1875/6767/files/airdrop_iphone_vers_android.pdf
    • https://cdn.shopify.com/s/files/1/0437/8945/1425/files/zofuxowipijurin.pdf
    • https://cdn.shopify.com/s/files/1/0430/1848/5923/files/34018598993.pdf
    • https://cdn.shopify.com/s/files/1/0436/6427/7657/files/refraction_of_light_class_11_notes_download.pdf
    • https://cdn.shopify.com/s/files/1/0433/0582/8520/files/21640977315.pdf
    • https://cdn.shopify.com/s/files/1/0434/2225/3208/files/popubagaginonobokopamaka.pdf
    • https://cdn.shopify.com/s/files/1/0431/2042/7157/files/cpwd_publications.pdf
    • https://cdn.shopify.com/s/files/1/0439/4477/1739/files/73589044673.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077fd.bin
fa403a3b6a8f5e28ddf8340c26af8d4dd6e61c58a98fbfeb661adb95b24583b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77FD 4896 bytes
font_01_sfnt_off0000887d.bin
d2dc2640c42fa29ce32e4d0c4bebfb83a3d5d33dc5e8bfedc4fb94dc8edf907f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x887D 10012 bytes
font_02_sfnt_off0000ab15.bin
b8600c10624652acedd38c2f6d8277c1ebe64c99021149a576f4630c078d0f51		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB15 20428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.