Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ed8df137bde9db9…

MALICIOUS

PDF

45.2 KB Created: 2020-08-31 09:57:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 44f92bb634f3f7bfc74715c5b30c1095 SHA-1: 75e2a02b0a75b1d81704c6a6b512675e0236c8b1 SHA-256: 8ed8df137bde9db9a220cdef7b4e9c23415006eaa636d4d8555387f7f617c91c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a redirector service. One critical heuristic identified a PDF link to known malicious redirector infrastructure. The document body contains a URL that is also flagged as malicious, suggesting a phishing or redirection attempt to a malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=miles+upshur+face
    • https://static.usrfiles.com/ugd/7dd30d_02675a4e43254edebb8da9a8699527e0.pdf
    • https://static.usrfiles.com/ugd/b8c837_6cd13bc5671c41d9bfb1df8e0549c6cc.pdf
    • https://static.usrfiles.com/ugd/80c1db_e4be0be9aebd40b0ac730ff48f6d77b8.pdf
    • https://static.usrfiles.com/ugd/b8c837_0ffcbf767bb94722aee14a6f639daab1.pdf
    • https://cdn.shopify.com/s/files/1/0430/7448/6421/files/cnc_turning_programming_fanuc.pdf
    • https://cdn.shopify.com/s/files/1/0435/3861/2378/files/meteorology_today_10th_edition.pdf
    • https://cdn.shopify.com/s/files/1/0431/9599/0175/files/sebozidolizibomabe.pdf
    • https://cdn.shopify.com/s/files/1/0429/1916/6105/files/bivogosogalubewamonivuw.pdf
    • https://cdn.shopify.com/s/files/1/0438/4797/5062/files/31045163880.pdf
    • https://cdn.shopify.com/s/files/1/0443/0535/0812/files/ntr_biopic_movie_audio_songs_free.pdf
    • https://cdn.shopify.com/s/files/1/0431/5008/2202/files/kokunevejulozujelego.pdf
    • https://cdn.shopify.com/s/files/1/0434/8660/9573/files/mazemo.pdf
    • https://cdn.shopify.com/s/files/1/0429/8624/2209/files/50026074751.pdf
    • https://static.usrfiles.com/ugd/b88e3d_1e45c16c34ce4421ad1e914bfc82278a.pdf
    • https://static.usrfiles.com/ugd/b88e3d_0e51eba81d1840d69d682d00b3b55f84.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000673c.bin
fc2f4f96689b6f528c045c013bfb955276134d8232f64b4e31f3597819aa0610		 pdf-font-stream PDF embedded font (sfnt) at offset 0x673C 4696 bytes
font_01_sfnt_off00007744.bin
a60bf75c8c5461dfc55c5be05420a49a9d7d0fa2a5902618ba080d078dea8a82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7744 10200 bytes
font_02_sfnt_off00009a33.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A33 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.