Malicious PDF — malware analysis report

Static analysis result for SHA-256 a07cc25107b97f93…

MALICIOUS

PDF

46.5 KB Created: 2020-10-16 21:20:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86cc3ef502816b8e25bec929c54fc4a9 SHA-1: d7e685ab6446b0fb8a5c35650cba7838b1512294 SHA-256: a07cc25107b97f9335f55c2c0a521b23401af0e1537c8ae4b14228447b7a360c
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body also contains text related to file conversion, suggesting a lure to trick users into clicking the malicious link. The presence of a 'Password-protected archive handoff' heuristic indicates that this document is likely part of a multi-stage attack, where the user is instructed to download a password-protected archive, which would typically contain the actual malware payload.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=convert+rar+file+to+pdf+format
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/wovexofek.pdf
    • https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/7fde262bb4b.pdf
    • https://fidegobopoj.weebly.com/uploads/1/3/2/8/132815019/gixadur-diwudo-geruw-rirubopusabupi.pdf
    • https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/2697538.pdf
    • https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/ligewajinaxi.pdf
    • https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/nurogagobepakopemaki.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/megaruxugujixirutati.pdf
    • https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/zogafa.pdf
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/busixakowun_zefisuni.pdf
    • https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/goxarujemexogu_mosegozivi_fofuwad_kezobal.pdf
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3731638.pdf
    • https://rabexowubomisuw.weebly.com/uploads/1/3/1/4/131407155/kakiwipukof_babinapowenuzad_muxepurerazefef.pdf
    • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/xenemavurinap_jokepirewiteda_fijalezej_gemewije.pdf
    • https://fobewesepujub.weebly.com/uploads/1/3/2/3/132303403/kexamali_gipaz_zewixaberobax.pdf
    • https://uploads.strikinglycdn.com/files/d40b8cfe-d371-4dd8-9ce6-45b0d8683293/1840794334.pdf
    • https://uploads.strikinglycdn.com/files/13cc0513-7da1-4cbe-b74c-8ca8a507ce71/tinomixagavadelejuz.pdf
    • https://uploads.strikinglycdn.com/files/69aba8c0-f59e-400c-a0bc-afcbb507c42f/66908845308.pdf
    • https://uploads.strikinglycdn.com/files/bd42b6ac-0f13-4a70-bd21-daa1fb555669/53149398951.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007875.bin
9eaaae215ac2e9e7851724efd50cfb28c5f774978bc32f57edc41a8f476b2234		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7875 4972 bytes
font_01_sfnt_off0000894c.bin
8a1eac8dbfaeb265e45120f911f45eacf3a1ea06387a2c8eaaf83d1a9c40a330		 pdf-font-stream PDF embedded font (sfnt) at offset 0x894C 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.