Malicious PDF — malware analysis report

Static analysis result for SHA-256 92ccd5ba951f1701…

MALICIOUS

PDF

80.2 KB Created: 2020-07-31 13:25:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5478bed9a2ade8f26e2fbfbf22001dca SHA-1: 5887638e8efdf029fe6fc6e2fdf03645ac9ff68b SHA-256: 92ccd5ba951f17019cca4d02d8c69a32ec906f8ca4800e2855a73eb91bb1c719
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a link farm, embedding a significant number of external links. One of these links, 'https://ttraff.cc/pify?keyword=sindrome+de+apnea+hipopnea+del+sue%25C3%25B1o+pdf', is identified as a malicious redirector. The presence of numerous links, including those pointing to potentially malicious infrastructure, suggests an attempt to lure users to harmful sites. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine the exact nature of the lure beyond the link farm.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=sindrome+de+apnea+hipopnea+del+sue%25C3%25B1o+pdf
    • http://files.georginaperezsboe.com/uploads/1/3/0/7/130776183/cb9cd0.pdf
    • http://files.stephenhowardharrison.com/uploads/1/3/1/3/131383649/2b97e49dd.pdf
    • http://files.gurmukhilipi.org/uploads/1/3/2/8/132815342/fb6a7d3ae00.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zorugeligix.pdf
    • https://cdn.shopify.com/s/files/1/0430/0197/0837/files/futofaguparexidenenodadab.pdf
    • https://cdn.shopify.com/s/files/1/0432/0939/2285/files/nepaku.pdf
    • https://cdn.shopify.com/s/files/1/0432/2131/9837/files/fumipegasefamabezuwo.pdf
    • https://cdn.shopify.com/s/files/1/0428/5746/3971/files/67311788144.pdf
    • https://cdn.shopify.com/s/files/1/0432/1024/4256/files/wibuvironelamumapid.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/15501301831.pdf
    • https://cdn.shopify.com/s/files/1/0429/7680/5023/files/nobuf.pdf
    • https://cdn.shopify.com/s/files/1/0431/6558/1469/files/zepate.pdf
    • https://cdn.shopify.com/s/files/1/0434/4119/3110/files/jotedamemifozulifukebego.pdf
    • https://cdn.shopify.com/s/files/1/0430/7920/5013/files/nugimimarolidebirufev.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/90209356055.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f958.bin
d94609f5a66cc9c19ec77bb5d9ee3e4ed1dd50bb2a7663c40265e80cdf17ab64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF958 5400 bytes
font_01_sfnt_off00010b28.bin
8571c2b9a51a98176c53bdfff8d9b15b19e6716777d23111b716c2e19cdad3cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B28 11852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.