Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4a40fda1a1b7197…

MALICIOUS

PDF

37.5 KB Created: 2020-08-27 18:12:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 42f646d28306c9dc269db2dd1adb8ffe SHA-1: 0964941cfa956d0211792464ddfdf63f7c59e5ba SHA-256: a4a40fda1a1b7197f5ebd8aecf0c0c128c7c2aa94eec2b18c23460d53cdb99cb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded URLs, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure related to educational materials, specifically 'Matematicas geniales 4 santillana contestada'. The primary heuristic indicates the PDF links to known malicious redirector infrastructure, suggesting an attempt to lead the user to a harmful site. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=matematicas+geniales+4+santillana+contestada
    • http://mivek.narrowgategraphics.com/uploads/1/3/0/7/130775732/5745061.pdf
    • https://cdn.shopify.com/s/files/1/0432/4841/8973/files/55318317915.pdf
    • https://cdn.shopify.com/s/files/1/0431/7023/4524/files/20275348342.pdf
    • https://cdn.shopify.com/s/files/1/0433/6173/0718/files/revitatowofukunugowuz.pdf
    • https://cdn.shopify.com/s/files/1/0431/6626/9597/files/juradidozorisuzid.pdf
    • https://cdn.shopify.com/s/files/1/0430/3421/4561/files/afscme_13_grievance_form.pdf
    • https://cdn.shopify.com/s/files/1/0429/7680/5023/files/tezadaxapodona.pdf
    • https://cdn.shopify.com/s/files/1/0451/3356/2010/files/sevajaxivikuremobe.pdf
    • https://cdn.shopify.com/s/files/1/0429/5704/5913/files/40394365717.pdf
    • https://cdn.shopify.com/s/files/1/0436/0703/1966/files/diferencia_entre_amperaje_y_voltaje.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/96226605796.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000517e.bin
259f5c52947627a08185b23a53ef43c41bfbb78b58fd55d5ac6dc2db894c8249		 pdf-font-stream PDF embedded font (sfnt) at offset 0x517E 5256 bytes
font_01_sfnt_off00006354.bin
b9075ea6753123ebc9987c68fd40dc8d0f5b0050b8989500e5f4ae5d85e120dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6354 11060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.