Malicious PDF — malware analysis report

Static analysis result for SHA-256 b117afc05863e978…

MALICIOUS

PDF

40.1 KB Created: 2020-09-03 02:46:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 77b83a794c3b7fbc7324979d46250747 SHA-1: f6e6af3d856dfe0a1af299c5a216035f44b1e6fd SHA-256: b117afc05863e978d152cb840844abfe05e6ebec6b45c78a365267d88e4ad138
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains multiple embedded URLs, with one critical heuristic identifying a link to a known malicious redirector. The document body, though partially corrupted, contains text suggesting a lure related to "best spreadsheet for macbook" and includes the malicious URL. This indicates an attempt to redirect the user to a malicious site, likely for phishing or malware distribution.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=best+spreadsheet+for+macbook
    • https://cdn.shopify.com/s/files/1/0432/5844/5979/files/70252296668.pdf
    • https://cdn.shopify.com/s/files/1/0437/0500/8293/files/tecnologias_de_la_informacion_2_udg_libro.pdf
    • https://cdn.shopify.com/s/files/1/0430/7212/7125/files/tesosajotusekig.pdf
    • https://cdn.shopify.com/s/files/1/0440/7610/5893/files/53927136329.pdf
    • https://static.usrfiles.com/ugd/1df9ea_70ae7d65269f46cbacc8d27ab0684ffc.pdf
    • https://cdn.shopify.com/s/files/1/0434/8205/4813/files/bulezefokijodozidub.pdf
    • https://cdn.shopify.com/s/files/1/0429/5501/4297/files/sonixapetibedikajuver.pdf
    • https://static.usrfiles.com/ugd/74e9cf_6cccfa0d26364e93b45dc7fdf324dc0c.pdf
    • https://static.usrfiles.com/ugd/808cd0_c9ff8834fa6e40638d3bd53ad68016d1.pdf
    • https://static.usrfiles.com/ugd/b8c837_293e9a8adda444519479fe0f31be8d2a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005d60.bin
98ed61a06ed769336121bd6bd36b8eb3ab72b3c1e25682904498b4fe422388a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D60 5616 bytes
font_01_sfnt_off00007047.bin
bdec7dd5993344f93209846d54de863bbbd805e5bbbd901f8be6cbf1cb670efa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7047 10572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.