Malicious PDF — malware analysis report

Static analysis result for SHA-256 87de9ab79c3354b3…

MALICIOUS

PDF

40.2 KB Created: 2020-08-15 02:14:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: feab2d4e008fc351d80365aea1ba8552 SHA-1: e4df92ba30d6edea78d1ecab3c9a7bf03e8d4f70 SHA-256: 87de9ab79c3354b33d091af7daf0ccaf13715cd7d65dec39fe7ac080cf56c3a0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a malicious URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to 'English movies hd free sites' and the malicious redirector URL. The PDF_SEO_LINK_FARM heuristic indicates a mass of external PDF links, suggesting an attempt to manipulate search engine results or distribute content widely. The primary malicious IOC is the redirector URL, which is likely used to funnel users to further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=english+movies+hd+free++sites
    • http://files.wichitafallsbridge.com/uploads/1/3/1/6/131606128/624ac.pdf
    • https://cdn.shopify.com/s/files/1/0429/3538/6275/files/mazubiposomivif.pdf
    • https://cdn.shopify.com/s/files/1/0446/4377/8723/files/arkitektura_e_kompjuterit_agim_cami.pdf
    • https://cdn.shopify.com/s/files/1/0433/3957/9546/files/tenawufelumalije.pdf
    • https://cdn.shopify.com/s/files/1/0431/7449/4369/files/bebosajiw.pdf
    • https://cdn.shopify.com/s/files/1/0433/8574/9665/files/mukilulolekugug.pdf
    • https://cdn.shopify.com/s/files/1/0428/5431/8239/files/windwalker_stat_priority.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/fovurasavelibegesixaga.pdf
    • https://cdn.shopify.com/s/files/1/0434/1743/6327/files/zizowupekojovupepuna.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32878299647.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ff2.bin
092d7c874b632cc4116ada2db2e8eed4ea44e908f87f1bc36c3c63c539c8b779		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FF2 5128 bytes
font_01_sfnt_off0000713f.bin
02c997c5326d26d97c02b1dd9eab97bb3fe1359958eda5c755ed55f83e2dfde2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x713F 10376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.