Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7a5568d305e469f…

MALICIOUS

PDF

49.8 KB Created: 2020-08-05 14:11:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4acf76b4e210eff77b556543eabe853a SHA-1: c1dca9d644af8a69f4d831b70d5f685f34f2d18d SHA-256: b7a5568d305e469fed0c1ddeab3f045b11f31a49606e48c565e105f4d8e65d6e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded links, with one critical heuristic firing indicating a malicious redirector. The document body, though partially corrupted, contains text related to 'Brihaspati dev ki aarti pdf' and the malicious URL is present. The primary attack vector appears to be a link farm designed to redirect users to malicious infrastructure.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=brihaspati+dev+ki+aarti+pdf
    • http://files.dynamichealinghomeopathy.com/uploads/1/3/1/3/131380600/dejoponidometo.pdf
    • http://files.marilynandco.com.au/uploads/1/3/0/9/130969297/pulovevejepubujor.pdf
    • http://files.pvcseagles.com/uploads/1/3/1/3/131381658/wuzedurojejerawuso.pdf
    • https://cdn.shopify.com/s/files/1/0434/7772/9442/files/35711090724.pdf
    • https://cdn.shopify.com/s/files/1/0433/0225/6795/files/17243176154.pdf
    • https://cdn.shopify.com/s/files/1/0438/5924/7264/files/80362190399.pdf
    • https://cdn.shopify.com/s/files/1/0434/7687/7478/files/43387009719.pdf
    • https://cdn.shopify.com/s/files/1/0434/6318/0438/files/ssh_secure_shell_downloads.pdf
    • https://cdn.shopify.com/s/files/1/0429/6753/1673/files/60686907197.pdf
    • https://cdn.shopify.com/s/files/1/0428/4196/4710/files/47698857111.pdf
    • https://cdn.shopify.com/s/files/1/0429/8879/8111/files/vuguvogivaxoneduwowabi.pdf
    • https://cdn.shopify.com/s/files/1/0436/6503/1321/files/35727344129.pdf
    • https://cdn.shopify.com/s/files/1/0434/0878/5562/files/88890662392.pdf
    • https://cdn.shopify.com/s/files/1/0437/3640/0037/files/53852474008.pdf
    • https://cdn.shopify.com/s/files/1/0439/1092/2392/files/74521364459.pdf
    • https://cdn.shopify.com/s/files/1/0431/4795/2292/files/24221737786.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005347.bin
80960c5ef920dc812f40421d0c41ad5272b60f71c1256c1bdf7a11afd8d5b2df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5347 2880 bytes
font_01_sfnt_off00005d84.bin
751eda3adeec6bfc35942796a18b4afdcbbb309064e445e677d6c64d41339bdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D84 4840 bytes
font_02_sfnt_off00006e0e.bin
75aa7e4402a49e2717fc31be2b36f51f6205766e9e12fbf59b5dc163ec4a4599		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E0E 12756 bytes
font_03_sfnt_off00009628.bin
ebd2804bff382343e08f6a42dc45f69f4e794c08b23908ae60ba78ededae74b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9628 16164 bytes
font_04_sfnt_off0000ab40.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB40 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.