Malicious PDF — malware analysis report

Static analysis result for SHA-256 be485539b3dc759f…

MALICIOUS

PDF

42.8 KB Created: 2020-08-30 02:08:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65770512692902c847660d74f5437a20 SHA-1: d19c952e5a5a0859f1f8d60e6c14c9398bbcfe05 SHA-256: be485539b3dc759ffb981362df8ee8a81a3ecffb87796681c6c481db4ddea01f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a mass external link farm, with a primary link pointing to a known malicious redirector. The document body, though partially corrupted, includes text related to 'memorial service invitation templates free' and the malicious URL, suggesting a social engineering lure. The PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms the link's malicious nature, indicating it likely leads to a further stage of attack.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=memorial+service+invitation+templates+free
    • https://static.usrfiles.com/ugd/b8c837_bb2dab041f91476bbe2e1167e20a9945.pdf
    • https://static.usrfiles.com/ugd/b8c837_84aa15f310db454fb859f21775e70940.pdf
    • https://static.usrfiles.com/ugd/c345b0_88a3652a53c146c6b8f9b23edfa81e2e.pdf
    • https://static.usrfiles.com/ugd/ea5d7b_74e8cf71d44a4fd68f44fb7874a8ef01.pdf
    • https://cdn.shopify.com/s/files/1/0433/7352/7203/files/logistic_regression_cost_function.pdf
    • https://cdn.shopify.com/s/files/1/0432/5064/7202/files/25843548185.pdf
    • https://cdn.shopify.com/s/files/1/0428/6621/3031/files/7598363672.pdf
    • https://static.usrfiles.com/ugd/b98abb_baf044723f7941eb9a84c30f63b96900.pdf
    • https://static.usrfiles.com/ugd/a01749_6bdba4ca511642fe826369cb980b14c7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005634.bin
ac1ef3e93a609c2338cc5a518393c786df392cbc2c5d8f577e7c884ba2a0403d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5634 5224 bytes
font_01_sfnt_off000067f2.bin
773d2297c500000bec7c31bda3d3338c03c3f3e92e75a41fd811712fc74884ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67F2 9856 bytes
font_02_sfnt_off000089d4.bin
096dc22bd3c9caec6309818842dfa19dd0da92d8ef7919229ff7edf1d3f8df14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89D4 16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.