Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ee2d7f406fa0a14…

MALICIOUS

PDF

61.4 KB Created: 2020-08-09 20:52:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ce5d86aa2479182fe3696b62b17ed96 SHA-1: a313ec21408dde42a9f0148b902e761efc41850a SHA-256: 8ee2d7f406fa0a143f8c9e38e17196e93302f770687aa001dd33214cdbdf8264
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, including a critical link to a known malicious redirector at https://ttraff.cc/pify?keyword=metaphysical+poetry+characteristics+pdf. This indicates a phishing or redirection attempt. The document body, though heavily obfuscated, also contains this URL, reinforcing the malicious intent. The file was generated by wkhtmltopdf, suggesting it was likely created programmatically for this purpose.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=metaphysical+poetry+characteristics+pdf
    • http://dovafifi.marleyrosereads.com/uploads/1/3/1/0/131069839/bapajus_gejudijef.pdf
    • http://files.ourhousecallvet.net/uploads/1/3/1/8/131857071/semosi-kimixasobal-baxokuw.pdf
    • http://fabuvut.montaukcandleco.com/uploads/1/3/0/9/130969440/4e7b14ce72e.pdf
    • http://files.hannahjpark.com/uploads/1/3/0/8/130873741/4923652.pdf
    • https://cdn.shopify.com/s/files/1/0438/3067/3565/files/47998739094.pdf
    • https://cdn.shopify.com/s/files/1/0433/6844/8152/files/67692245807.pdf
    • https://cdn.shopify.com/s/files/1/0430/6881/7562/files/90607098072.pdf
    • https://cdn.shopify.com/s/files/1/0439/9605/3662/files/efek_samping_antasida.pdf
    • https://cdn.shopify.com/s/files/1/0432/5064/7202/files/46807035882.pdf
    • https://cdn.shopify.com/s/files/1/0432/7243/7913/files/64334148997.pdf
    • https://cdn.shopify.com/s/files/1/0434/1599/4529/files/musidorofabiwopokanuwomib.pdf
    • https://cdn.shopify.com/s/files/1/0434/7628/7648/files/9934223493.pdf
    • https://cdn.shopify.com/s/files/1/0430/5698/8311/files/lexaziregowezo.pdf
    • https://cdn.shopify.com/s/files/1/0434/6635/8934/files/biology_notes_class_9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a767.bin
86809f46e27c1d0230d85cbffe69eb41eb40cbc47aff873548524ba38ea64a85		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA767 5032 bytes
font_01_sfnt_off0000b89f.bin
b8437c8067a11caf7e1ce1b3c9937968a27828fa2d2d223790a6600db1fe0ec1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB89F 9876 bytes
font_02_sfnt_off0000da61.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA61 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.