Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aef71357e6d4c73…

MALICIOUS

PDF

35.6 KB Created: 2020-08-30 11:56:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a195a0504f375b049fb4a06cc0c4d42 SHA-1: 43086beb0973cc209303282db7c0bb97130fb26a SHA-256: 9aef71357e6d4c7317c4e8ddc0a1738e7cdec86dccce9236df91bdbc1bffd8b5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link

The PDF file contains a link that redirects to a known malicious URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though partially corrupted, contains text related to a movie download lure, which is consistent with the malicious redirector's purpose. The PDF also contains a large number of external links, as flagged by PDF_SEO_LINK_FARM, suggesting a link farm for SEO poisoning or traffic generation, further supporting the malicious intent.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=fast+and+furious+7+1080p+free+downlo
    • https://static.usrfiles.com/ugd/ea78e0_8932cb7ae3fe4de89efb167c46b94b74.pdf
    • https://static.usrfiles.com/ugd/f09a9d_e1ace84de5304875bf0eee2b834fdfef.pdf
    • https://static.usrfiles.com/ugd/1f2646_433caf81e2974691a39d1dd5bf9531ac.pdf
    • https://static.usrfiles.com/ugd/34e21e_f7ebc9ac1f794b688d3563f4b53bdcc9.pdf
    • https://static.usrfiles.com/ugd/b8c837_4c1c454d54db450cae5065e5c133188e.pdf
    • https://static.usrfiles.com/ugd/6f7357_c5b9fdfda48b4b5eafdf978e4cd3c3a2.pdf
    • https://cdn.shopify.com/s/files/1/0431/3455/0173/files/fusukubulufakixumeburix.pdf
    • https://cdn.shopify.com/s/files/1/0435/8645/3663/files/ladesusunitujisizuk.pdf
    • https://cdn.shopify.com/s/files/1/0429/5199/9637/files/ruxeve.pdf
    • https://cdn.shopify.com/s/files/1/0432/2331/8686/files/sejatuladuset.pdf
    • https://static.usrfiles.com/ugd/b8c837_f3a5991bec5e4334a69d2fa0767e093f.pdf
    • https://static.usrfiles.com/ugd/b8c837_da641bfb739c4c13890db8ffbc1f5b1d.pdf
    • https://static.usrfiles.com/ugd/0e9fc2_43b682ab2cb942ba8e4293bb4003762a.pdf
    • https://static.usrfiles.com/ugd/4c1554_582324cca97142d28f92f729f4b22fac.pdf
    • https://static.usrfiles.com/ugd/bb13a2_0af101daa85f49e588107fab00f7a29b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b3a.bin
f44fcd2b85c1e60ff4ac5614d4d17272fceaff3ad7a4f0f9665921fdd75ba084		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B3A 5552 bytes
font_01_sfnt_off00005e42.bin
fc65d25e99733461cab2634938b7ee9fe89b7a021aef0a5da7840479b0697c29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E42 10220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.