Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd697c698a81c825…

MALICIOUS

PDF

45.7 KB Created: 2020-09-02 07:49:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 721a77fa576293530a07e2d45d4dabc3 SHA-1: 2536a73f628e0c04621f3ebb15cc7bb8ef8a6935 SHA-256: bd697c698a81c82540e6123d6322073346ca88acab90004d26ed52ea73278d62
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with one prominent link directing to a malicious redirector. The document body, though heavily obfuscated, contains text referencing 'utorrent pro apk android 2.3' and a URL that appears to be part of a SEO spam campaign. This suggests the document is designed to trick users into downloading potentially unwanted or malicious software by leveraging search engine optimization and deceptive content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=utorrent+pro+apk+android+2.+3
    • https://static.usrfiles.com/ugd/aef5b7_27727a97b2e04d8bb6852e1d945681d2.pdf
    • https://static.usrfiles.com/ugd/b8c837_538a3004cfb24491a324444b13a946c3.pdf
    • https://static.usrfiles.com/ugd/05301a_2ac1dd37ceb944b29140cc1a18c5764f.pdf
    • https://static.usrfiles.com/ugd/9ea91e_e46c575ee5db49789754287c9f96aa5b.pdf
    • https://static.usrfiles.com/ugd/0d2fda_a22bef6544604ab29e62b9e817082655.pdf
    • https://cdn.shopify.com/s/files/1/0435/3199/3242/files/advanced_excel_tutorial.pdf
    • https://cdn.shopify.com/s/files/1/0448/3471/7858/files/54056222679.pdf
    • https://static.usrfiles.com/ugd/b5472a_86e234b50ade4b56a1d92702b8cdd2f1.pdf
    • https://static.usrfiles.com/ugd/682d1c_2d014f2296a64459972c1da9c0b3332b.pdf
    • https://static.usrfiles.com/ugd/b8c837_d959ab4ea29e44358bc3c9c5325339e3.pdf
    • https://static.usrfiles.com/ugd/6908d7_d3b9f2c5095f48b98fd15c8e751bc00a.pdf
    • https://static.usrfiles.com/ugd/370b54_83c7ba79c01d4e4ab39697f7dce2ed0b.pdf
    • https://static.usrfiles.com/ugd/b8bbd7_56ebec7dea294a3f9e164b3ad0e235a9.pdf
    • https://static.usrfiles.com/ugd/031dda_a083037d451f403bb6e16a89cdcdc73a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055a1.bin
bb3482f1a485b279bc15723e7134081d418eb117b436f7ad511d410e068d6556		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55A1 5128 bytes
font_01_sfnt_off00006733.bin
03f66c09d39f4712b37ac97703c5cffe1dead22ba1097df56b40cc1143deb25e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6733 13692 bytes
font_02_sfnt_off000092f5.bin
40453978de80e77b8b3968ad6a431cf66d40a67e5b6ecec3fd9abb74e0e204a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92F5 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.