Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9c3a8ef6f68bea0…

MALICIOUS

PDF

55.7 KB Created: 2020-09-17 00:46:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 10884a6125298b342015016c886d8c90 SHA-1: dc2ef4013d22f008488d80424cc9ac25d487b37b SHA-256: b9c3a8ef6f68bea0c0b998642358d169806cef47a1c114b98980db981b5ad2ff
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a high number of embedded links, with a critical heuristic firing for a PDF link farm. One of these links, 'https://ttraff.link/wix?keyword=apk+amc+security', is identified as a malicious redirector. The document body also contains urgency language, reinforcing the lure to click the malicious link. No scripts were extracted, but the primary attack pattern involves redirecting the user to malicious infrastructure.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=apk+amc+security
    • http://files.fullforcesdfit.com/uploads/1/3/1/4/131482953/bb040299ebab.pdf
    • http://rikop.bestofbothworldsnc.com/uploads/1/3/1/3/131398455/xanonu.pdf
    • http://files.canterburynuts.com/uploads/1/3/0/8/130874213/zalepu_xumamasepo_jenapolij_nelawovude.pdf
    • https://cdn.shopify.com/s/files/1/0438/5452/8677/files/bwapp_tutorial.pdf
    • https://cdn.shopify.com/s/files/1/0435/1187/3688/files/35068418170.pdf
    • https://cdn.shopify.com/s/files/1/0430/6223/1201/files/hindi_project_file_class_12_cbse.pdf
    • https://3a8687ec-9628-404a-9b2a-bd310fec1810.filesusr.com/ugd/405339_a716df50c0c842da87537a59ce535934.pdf?index=true
    • https://f5b580e6-833a-4a23-856d-61b61956e432.filesusr.com/ugd/e6092c_029bd91824644884a82296c9ba3f05fe.pdf?index=true
    • https://f33e7f05-1d34-4746-b687-3ba1ae334a3b.filesusr.com/ugd/ef0078_2aea00b465ec4b62b2a2ef10fe6a5cbd.pdf?index=true
    • https://ba246c65-9584-4895-a935-000002cfe93d.filesusr.com/ugd/5aec95_41b32e84d4924710bea951de4515c6b6.pdf?index=true
    • https://6e7e776b-753c-4b3a-a84d-4086bf3fbb55.filesusr.com/ugd/d99ef3_3297ab2e7c0e4a3f951e6e4ce58fb5f0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fdc.bin
e42012e0a20de963b83d9bf476a601e1e1e43fced2be95fde6cbf99cc1139275		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FDC 3500 bytes
font_01_sfnt_off00007c7a.bin
1057f9ce64817ba3c9abc0d12bb70e1cf85e9af546bba254fd9f071f1cd4c15b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C7A 5204 bytes
font_02_sfnt_off00008e15.bin
daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8E15 1800 bytes
font_03_sfnt_off000096a3.bin
c0ce68530d6fcbd21d5425d3c35cd5a8434f776a0b8e413a78f5b96b01331086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96A3 10812 bytes
font_04_sfnt_off0000bbd8.bin
f6e0f4a25f18a144688c6b7f40519a5efc98c72643b9054f89526e396d9b459d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBBD8 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.