Malicious PDF — malware analysis report

Static analysis result for SHA-256 937aa1e847d522bb…

MALICIOUS

PDF

55.0 KB Created: 2020-08-21 06:24:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 49bbcbbb3da74fa3572e9d5fefc5677f SHA-1: 88d3ba06c46dc686ec7f20a6bb444153e866e156 SHA-256: 937aa1e847d522bb19bccc9c6935517d1cb28aabf5caab13fc366d09cf8273b7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=bandook+chalegi+teri+dj+mix+song'. Additionally, it exhibits characteristics of a PDF link farm, with numerous external PDF links, including suspicious ones like 'http://xeneg.movequickly.eu/uploads/1/3/1/3/131383483/gimuk.pdf'. The document body, though heavily obfuscated, also contains the primary malicious URL, suggesting the document's purpose is to lure users to this external resource.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=bandook+chalegi+teri+dj+mix+song
    • http://xeneg.movequickly.eu/uploads/1/3/1/3/131383483/gimuk.pdf
    • http://files.lavendershop.org/uploads/1/3/0/8/130813648/8930624.pdf
    • https://cdn.shopify.com/s/files/1/0435/3651/5224/files/47929364187.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32829552166.pdf
    • https://cdn.shopify.com/s/files/1/0440/7279/6310/files/ctp_guide_marvel_future_fight.pdf
    • https://cdn.shopify.com/s/files/1/0429/2198/4166/files/73428119497.pdf
    • https://cdn.shopify.com/s/files/1/0432/0886/8008/files/jiveliruzapesiluzezawiwo.pdf
    • https://cdn.shopify.com/s/files/1/0431/2530/9604/files/watufavipimujasuzuxeboged.pdf
    • https://cdn.shopify.com/s/files/1/0434/0688/5027/files/ya_devi_sarva_bhuteshu.pdf
    • https://cdn.shopify.com/s/files/1/0432/0998/2107/files/jurelolufoxobi.pdf
    • https://cdn.shopify.com/s/files/1/0437/0713/8201/files/c_piano_chords.pdf
    • https://cdn.shopify.com/s/files/1/0448/1299/2674/files/vizix.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/lipowu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005308.bin
84b72ee7c01912f9975d22fe0ff9c5bce3bd2e456b6da791d525ce7f41b1eac5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5308 5612 bytes
font_01_sfnt_off000065ed.bin
d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65ED 3720 bytes
font_02_sfnt_off00007148.bin
fa00ca2efb3740422adce526fcbaa5037a21e39b9482affa9e7d95016e3f9ad0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7148 2528 bytes
font_03_sfnt_off00007c78.bin
2e2522a753dca17513a3542d47b9ee1874985fc4ba6b6bfc5613d6622bac076c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C78 14784 bytes
font_04_sfnt_off0000a9cf.bin
bcfecb9fde4b74e4a2b692e15caf305b2988a1cfe4c6386614002e38d35feb86		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA9CF 16168 bytes
font_05_sfnt_off0000bf11.bin
19655ef2c5c36af2ea81ec1e888c74146daa86caac81255a64ec898c8877a1e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF11 3816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.