Malicious PDF — malware analysis report

Static analysis result for SHA-256 af44b8828fa2cc12…

MALICIOUS

PDF

52.9 KB Created: 2020-08-20 14:26:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e6fed497e2569b435e50a87a62effc9 SHA-1: 37bb39c42b2dba033cef23f2fd716bf3727e9181 SHA-256: af44b8828fa2cc1259fe8267aa15989c10a3a595afca8fdb50098222b22cff9e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded links, with one heuristic specifically identifying a malicious redirector. The document body, though partially corrupted, contains text related to 'advanced discrete mathematics notes pdf' and a URL that matches the malicious redirector. This suggests a social engineering attempt to trick users into visiting a malicious site by disguising it as academic content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=advanced+discrete+mathematics+notes+pdf
    • http://files.jasmoseley.com/uploads/1/3/1/3/131384429/gotitefewodek_vabilox_tuxuzaxejoka_pimapili.pdf
    • http://files.fxbrwanda.org/uploads/1/3/0/9/130969809/tubetavowavamoz_ferorilobu.pdf
    • http://rokozad.kimsadesign.com/uploads/1/3/0/7/130739377/8731885.pdf
    • http://wawijerip.npsmusicsound.com/uploads/1/3/1/3/131398109/5b32ca1.pdf
    • https://cdn.shopify.com/s/files/1/0436/8711/6965/files/karl_marx_conflict_theory_essays.pdf
    • https://cdn.shopify.com/s/files/1/0438/5865/7430/files/zibolotiruxepij.pdf
    • https://cdn.shopify.com/s/files/1/0437/6035/3429/files/kpop_quiz_2016.pdf
    • https://cdn.shopify.com/s/files/1/0431/4474/1024/files/finekelimeliw.pdf
    • https://cdn.shopify.com/s/files/1/0431/0476/4068/files/mudoramuxafekomitarititud.pdf
    • https://cdn.shopify.com/s/files/1/0433/7487/0689/files/original_affluent_society.pdf
    • https://cdn.shopify.com/s/files/1/0437/7939/1646/files/95009731354.pdf
    • https://cdn.shopify.com/s/files/1/0435/1141/4939/files/4056734447.pdf
    • https://cdn.shopify.com/s/files/1/0440/8731/2534/files/download_livro_admiravel_mundo_novo.pdf
    • https://cdn.shopify.com/s/files/1/0430/4135/7973/files/rorugijenijisoxutajat.pdf
    • https://cdn.shopify.com/s/files/1/0436/0765/4563/files/67230127319.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071ef.bin
3be7945896c1cc74360e303f4c802daec47b599e33ad15729195d7d68d6ec4cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71EF 5412 bytes
font_01_sfnt_off0000842c.bin
79d0c46c236b4b4fe6417048db43d13775a1c744a4d7a2d7dfa752c5884ba0dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x842C 12728 bytes
font_02_sfnt_off0000ae1c.bin
1494e5552df799d94b3b68bebddc71bf811e36043ba76cf76e39b3260abdad63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE1C 16876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.