Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ab30c92ca3fe916…

MALICIOUS

PDF

40.9 KB Created: 2020-09-04 19:41:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3f63b52f33ae0ffb8df51eb9fb780f85 SHA-1: e5d4de4bfd912b23736d8149e329240d995f2226 SHA-256: 9ab30c92ca3fe916eef59ba6c63a8aa1a93e098b401526ee6e9db47ef8f781fe
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a known malicious domain, disguised with text related to passport officer recruitment. This indicates a phishing attempt to lure users to a malicious site. The PDF also contains a large number of links to other PDFs hosted on Shopify, likely for SEO manipulation to improve the ranking of the malicious link.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=application+form+for+passport+officer+recruitment+2019
    • https://cdn.shopify.com/s/files/1/0430/9729/2949/files/lanidokiz.pdf
    • https://cdn.shopify.com/s/files/1/0431/9923/4203/files/ziwawitesufozoduwewamil.pdf
    • https://cdn.shopify.com/s/files/1/0432/0142/9662/files/8115296008.pdf
    • https://cdn.shopify.com/s/files/1/0434/7586/1656/files/bhagwat_katha_gujarati.pdf
    • https://cdn.shopify.com/s/files/1/0431/9959/4656/files/22384297402.pdf
    • https://cdn.shopify.com/s/files/1/0436/1306/1277/files/akn_gzyalar_2.pdf
    • https://cdn.shopify.com/s/files/1/0430/3932/6365/files/capricorn_man_in_love_yahoo_answers.pdf
    • https://cdn.shopify.com/s/files/1/0439/7416/4638/files/aalavandhan_full_movie_isaimini.pdf
    • https://cdn.shopify.com/s/files/1/0431/3215/8116/files/minions_first_movie.pdf
    • https://cdn.shopify.com/s/files/1/0429/4190/7100/files/zobami.pdf
    • https://cdn.shopify.com/s/files/1/0432/2390/8520/files/digadetij.pdf
    • https://static.usrfiles.com/ugd/191a6d_fb9c42ae9e5e425fb962d81a79cbcfb9.pdf
    • https://static.usrfiles.com/ugd/cc03df_774427abf0664b589f49f5dc502f52cc.pdf
    • https://static.usrfiles.com/ugd/21e6f2_3c0ed22b21464f09aa3d8c5742305cfa.pdf
    • https://static.usrfiles.com/ugd/a18aa6_ad821ddebb7844d2b1fd56e2e2ca66a1.pdf
    • https://static.usrfiles.com/ugd/b8c837_af6b54b025fe416da52ec83a393ae1ad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000060bf.bin
155178102170a2e80d286ef4b8cafac90d1811800b5e333c93cff28fa0abb838		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60BF 5632 bytes
font_01_sfnt_off000073d7.bin
65af0326a856ebf0e31508b282c1cc19c89d0f7cd61df3e517631f593b0de08d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73D7 10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.