Malicious PDF — malware analysis report

Static analysis result for SHA-256 a36dd32bcd8e65b1…

MALICIOUS

PDF

40.9 KB Created: 2020-09-08 09:44:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 440aa1eb351953d2168f7b45ec3d1b36 SHA-1: 9cabfa43f8dc846566d6c4774b7c3f024ab01cb1 SHA-256: a36dd32bcd8e65b1f7ee43d53074e76d13104e46705b1f9154f058c1b5108a1f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a redirector service. The document body, though heavily obfuscated, contains text suggesting a lure related to 'music from soundcloud iphone'. The primary malicious IOC is the redirector URL, which is designed to lead users to further malicious content. The PDF also contains a link farm, indicating a potential SEO poisoning or spamming campaign.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=music+from+soundcloud+iphone
    • https://static.usrfiles.com/ugd/fac845_d975985feb0f46de9119172f8cd1b9f3.pdf
    • https://static.usrfiles.com/ugd/314c35_66689067ad28465abd8e45fc1dc51059.pdf
    • https://static.usrfiles.com/ugd/6f9b04_a8fd07fffe7b4c4da10c1d49af7b290a.pdf
    • https://static.usrfiles.com/ugd/9d66c7_a77afb0a6f4e4801ade660d8ac9eac2d.pdf
    • https://static.usrfiles.com/ugd/c8a981_2e7addaabdca493b863c054e92c62b64.pdf
    • https://static.usrfiles.com/ugd/66f7a0_27365b20738f4b24ad79b1b5f7906750.pdf
    • https://static.usrfiles.com/ugd/234f58_87bc0ac9cfc74a40a3f3864426675852.pdf
    • https://static.usrfiles.com/ugd/b8c837_e1dbbfb8f8a042a18d05d0f8565bf543.pdf
    • https://static.usrfiles.com/ugd/f6336d_2ef9ad26e86b455ba067ea08c1f8470c.pdf
    • https://static.usrfiles.com/ugd/0a51c1_6db256dab669434cb35821b8d38789cb.pdf
    • https://cdn.shopify.com/s/files/1/0441/2764/9944/files/mitetufinisulime.pdf
    • https://cdn.shopify.com/s/files/1/0434/3971/8552/files/getiludazugo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000611c.bin
4b6e4ab1cdd04328e2d71b7e5ac3ce8b3757c699b23dac44d57525549d77569b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x611C 5188 bytes
font_01_sfnt_off000072a3.bin
1e6530554a766d7c06d183abcfdafe480e10b21e6eecb5b75e2ab2fc21b060ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72A3 10676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.