Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d0894b01501234d…

MALICIOUS

PDF

37.7 KB Created: 2020-09-17 21:51:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 625122c2d9696c0ae34063326d0e3628 SHA-1: 92970ba428efc8a920f776af81c6634d7cf4be7c SHA-256: 8d0894b01501234d970c3830ed3e4902cc4cfac73086a091d8ef55b75ea27641
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with one URL pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to "projectile motion practice problems with solutions pdf" and the malicious URL, suggesting a lure to a phishing or malware distribution site. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=projectile+motion+practice+problems+with+solutions+pdf
    • http://files.seatingincstateofgeorgia.com/uploads/1/3/0/8/130813715/fe786.pdf
    • https://046271e0-5544-4b74-9052-808681b28479.filesusr.com/ugd/2994dd_d82977ef085c4c598a4996df0858ba6f.pdf?index=true
    • https://df6b0079-ba05-436e-a211-ae890a0f2335.filesusr.com/ugd/dfb5f8_f45422fbb67046f6b49ce6c7fd1d17c1.pdf?index=true
    • https://1527a2b4-b46d-4d08-8221-8df5e011a3f0.filesusr.com/ugd/03dcd4_3a064ba83ba54132a1fa59e05ef2097a.pdf?index=true
    • https://0e6cd927-3879-45a8-9040-b54c7807f5d2.filesusr.com/ugd/d19ca0_fa2f45bfbe4b45a5879187ff1060363e.pdf?index=true
    • https://fdcaacb7-2d45-4cf6-a619-492f1e83c3f0.filesusr.com/ugd/bfd78a_6ac9ec5db6c14f74ac0d654c5a0f9a13.pdf?index=true
    • https://9ec55537-67c9-4669-8aa5-25502e783bdf.filesusr.com/ugd/96564c_6712c51c4b6648e09d591a145df96f8a.pdf?index=true
    • https://1747b185-71c0-4c7d-8674-3ecaf596271b.filesusr.com/ugd/275374_63f9192f27c1408dac1dc86a942f6a96.pdf?index=true
    • https://f174d5b8-6cb7-455c-aed4-68d06ea0e2c9.filesusr.com/ugd/d6b5da_08bcb143d11249fcac55867a3d587289.pdf?index=true
    • https://4c08d960-50a3-4753-b15c-36dce5b3f03d.filesusr.com/ugd/4aae87_874b2aaf747b484c9d9817e9dacf5d01.pdf?index=true
    • https://f9f82adf-9ea5-471c-b7c9-05ba937a2515.filesusr.com/ugd/a9248e_7391b4c3961149afad3ee958e1bfe6b1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005474.bin
b2c9c9f9550cc53eae38386cf7140a639ce46f1cc94fe3511dd270a81398c7ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5474 5704 bytes
font_01_sfnt_off000067c0.bin
5b6a8ff784cbdcfbc2317ff6f6275ef07030b0f0f7971c3c1733115c2389f982		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67C0 9952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.