Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d660bccbcf08f22…

MALICIOUS

PDF

42.3 KB Created: 2020-07-08 12:06:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e4b361021e09f7d6e0deead58a40665 SHA-1: 2aa6e33a91a67a40584086a861dbda3013a368a5 SHA-256: 9d660bccbcf08f220f8691f271ef2bd6f439207ad69de6821011d65041db4d04
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to domains associated with SEO link farms. One prominent URL, https://ttraff.cc/wb?keyword=convert%20pdf%20to%20powerpoint%20software%20free%20download, is identified as a malicious redirector. The presence of a visual download button further supports a lure-based attack pattern. No scripts were extracted from this sample.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=convert%20pdf%20to%20powerpoint%20software%20free%20download
    • http://files.edsworldwide.org/uploads/1/3/2/7/132740320/sotilemiz-gukixedesimujar-bevulas-lativeponeji.pdf
    • http://files.5ivezero.com/uploads/1/3/1/4/131437538/boxuzuzege-jamov-susaxozokusonir.pdf
    • http://files.quitosltd.com/uploads/1/3/2/6/132681938/5b6a0c74.pdf
    • http://files.parkcityea.org/uploads/1/3/0/8/130874110/nurovarogokiwa.pdf
    • http://files.journeystoflavors.com/uploads/1/3/0/9/130969555/a18860d033.pdf
    • http://files.itrpath.com/uploads/1/3/1/4/131406295/baxixirinewasutolize.pdf
    • http://files.mychildstherapy.com/uploads/1/3/1/0/131071035/f73f22.pdf
    • http://files.lifewisegifts.com/uploads/1/3/0/8/130874128/6ab8d3.pdf
    • http://files.didsburyjuniors.com/uploads/1/3/2/6/132681824/maxipupamekep.pdf
    • http://files.yashbangera.com/uploads/1/3/0/7/130738625/83486b04a35.pdf
    • https://rilusepo.files.wordpress.com/2020/06/midabufavedewu.pdf
    • https://mexutux727649879.files.wordpress.com/2020/07/benetifupiferarep.pdf
    • https://zopudide.files.wordpress.com/2020/07/46746001857.pdf
    • https://zarenorazer.files.wordpress.com/2020/06/17727687158.pdf
    • https://pexibirivuk.files.wordpress.com/2020/07/garalakexelematix.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006929.bin
6972bb10e4e759b33fec6fc29b8c3f3f33db85748d95e3b58d865ada1efc6251		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6929 4996 bytes
font_01_sfnt_off00007a48.bin
e1acbf262540c6299d3e7e9994451d3e6427a7a0fadf76ea9ece3f68b23fc3f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A48 9896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.