Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0610ead832068f5…

MALICIOUS

PDF

46.7 KB Created: 2020-08-31 16:59:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b974eca659999958759c4fef301a9830 SHA-1: 110effd042d9b7fe34eb5c5f66eaa657ac895bc1 SHA-256: b0610ead832068f5c7cb3ec1f01dc4ca642f22a76322b0660905df2d8643cc27
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, with one critical heuristic firing indicating a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to 'Instagram story covers template' and a URL that aligns with the malicious redirector. The primary intent appears to be directing users to malicious content via the identified redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=instagram+story+covers+template
    • https://static.usrfiles.com/ugd/b8c837_f8c8e72cfd134f259c9e2dc85897efef.pdf
    • https://static.usrfiles.com/ugd/ad2ade_d17b6715172f4cf5af17ef04969acc15.pdf
    • https://static.usrfiles.com/ugd/b8c837_362ee51d3211409492a2b24e01d55663.pdf
    • https://cdn.shopify.com/s/files/1/0434/6822/6725/files/29662144811.pdf
    • https://cdn.shopify.com/s/files/1/0461/1457/0404/files/letter_asking_for_donation_template.pdf
    • https://cdn.shopify.com/s/files/1/0435/0348/5092/files/wolalovivezorimedovupe.pdf
    • https://cdn.shopify.com/s/files/1/0437/1028/3931/files/mebalifuriwizapazub.pdf
    • https://cdn.shopify.com/s/files/1/0429/6169/8969/files/kepinerimikoli.pdf
    • https://cdn.shopify.com/s/files/1/0436/9013/1609/files/mdicaments_de_l_appareil_respiratoire.pdf
    • https://cdn.shopify.com/s/files/1/0434/2883/9581/files/80438318651.pdf
    • https://cdn.shopify.com/s/files/1/0433/9128/7450/files/pekafilerixi.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/voriwatovetizejewadodo.pdf
    • https://cdn.shopify.com/s/files/1/0429/6795/7660/files/paliniz.pdf
    • https://static.usrfiles.com/ugd/be19e1_4ff9c24b7d39405c9d143380b57a85da.pdf
    • https://static.usrfiles.com/ugd/45e30f_32e51c63de334da3a4090348a04c79d3.pdf
    • https://static.usrfiles.com/ugd/b8c837_e768d5e8f43c4e5a89dd2279a42bb7e2.pdf
    • https://static.usrfiles.com/ugd/b8c837_fa69dcda05904dac861d848e4ad6c543.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077d4.bin
27c393fd536f8505962efa3972b1ad22eb8ba6505e3ddae2afd999eb0cf6fa24
pdf-font-stream PDF embedded font (sfnt) at offset 0x77D4 5352 bytes
font_01_sfnt_off00008a08.bin
13b80463cbc15db39ee0cfee0922df8d903daa05ee1e9036f9877d137cca8072
pdf-font-stream PDF embedded font (sfnt) at offset 0x8A08 10592 bytes