Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1d9bef6041536f9…

MALICIOUS

PDF

40.7 KB Created: 2020-09-09 20:49:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8baf04ff633f2c2f0089c7345be44579 SHA-1: a729f401ef88db52eceb361a8f69445282f333f1 SHA-256: a1d9bef6041536f96e8916af9a2a6e62ea13a7286b35439f6e2114810f0435ed
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the target URL and appears to be a lure for sermon-related content. The PDF_SEO_LINK_FARM heuristic indicates the presence of multiple external links, suggesting a link farm or SEO poisoning attempt. The primary IOC is the malicious redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=bosquejos+de+sermones+expositivos+bautistas+pdf
    • https://static.usrfiles.com/ugd/cb4a18_4708dc370b4c4ccda5b2eab3c30e33a3.pdf
    • https://static.usrfiles.com/ugd/bdc04d_68a8b135c01846ad81c8666bcfa02413.pdf
    • https://static.usrfiles.com/ugd/e2f197_6d13e4e9afe74e8d9d5690aefdd956ad.pdf
    • https://static.usrfiles.com/ugd/e5412a_2bfdc597fe8a477da248dd479488df5c.pdf
    • https://static.usrfiles.com/ugd/f14cf6_8f7e87db3af34ebca01e1bb8fea5231f.pdf
    • https://static.usrfiles.com/ugd/7ba596_e78bf8f9268043bfbf5486b68065c62f.pdf
    • https://static.usrfiles.com/ugd/b916f4_1747ccf7a2fa43668e3a0bc8b8c67710.pdf
    • https://static.usrfiles.com/ugd/b81754_8ab2f44b57cf4dd4861deb9c37c77201.pdf
    • https://static.usrfiles.com/ugd/3826db_3011ce3058b94a30904a18093ed15bb8.pdf
    • https://static.usrfiles.com/ugd/b8c837_26ed43872c814291802d3454cf9cf3b4.pdf
    • https://static.usrfiles.com/ugd/9cfd0a_2061fbeeb8c24be2aeefe00ee0862971.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005aea.bin
09130d1d9800cab11f251923d7307efd05c9e26ae377e49f07e63005b060a162		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AEA 5676 bytes
font_01_sfnt_off00006e27.bin
9dd92094047bb0fde43183c42a0f7dafcdfba11bffccadb88fb7e4cf33727f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E27 11836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.