Malicious PDF — malware analysis report

Static analysis result for SHA-256 be4c5148b8eed4b3…

MALICIOUS

PDF

55.0 KB Created: 2020-09-01 17:55:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a89ef69b2fb15f4520347c2e37f7982 SHA-1: 3dfe46f0928b6026f5693aa58f98d8132a0d9d3a SHA-256: be4c5148b8eed4b376403c58fd0d42b478c37da386a61afda1f37025668399a3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to a malicious URL, likely as part of a phishing or scam campaign. The embedded URL is associated with a 'Roblox hack' lure, suggesting an attempt to entice users to click through to a potentially harmful site. The PDF also contains a large number of external links, characteristic of SEO spam or link farms, further indicating malicious intent.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=roblox+hack+booga+booga
    • https://static.usrfiles.com/ugd/fa6f14_42a611f0db934541af0e675da018dde3.pdf
    • https://static.usrfiles.com/ugd/b8c837_22a277fea62c494f8fa2f190366ff8c7.pdf
    • https://static.usrfiles.com/ugd/fe83c3_226fd1f2c0524de1a8fe6160b6e1daec.pdf
    • https://static.usrfiles.com/ugd/b8c837_c44407b9b901460694c3080e5b5616a2.pdf
    • https://static.usrfiles.com/ugd/f103bb_cdb7c32f9653481b816038c664c57c6f.pdf
    • https://cdn.shopify.com/s/files/1/0432/4655/1208/files/vuxobamiloserem.pdf
    • https://cdn.shopify.com/s/files/1/0432/8567/6192/files/tsunami_worksheet_ks2.pdf
    • https://cdn.shopify.com/s/files/1/0457/7060/4700/files/ancona_range_hood_user_manual.pdf
    • https://cdn.shopify.com/s/files/1/0431/7623/1063/files/40327180561.pdf
    • https://cdn.shopify.com/s/files/1/0434/5826/5238/files/loxesixijokanowanubekavu.pdf
    • https://cdn.shopify.com/s/files/1/0437/1120/1435/files/3ds_max_commands_shortcuts.pdf
    • https://cdn.shopify.com/s/files/1/0438/0708/0608/files/statistics_freedman_4th_edition_download.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zosakasebiribo.pdf
    • https://cdn.shopify.com/s/files/1/0439/4260/9051/files/brute_force_iphone_password_cracker.pdf
    • https://static.usrfiles.com/ugd/565485_b81da8c83a834201a4c1447f38cf7383.pdf
    • https://static.usrfiles.com/ugd/7f929b_553ce50ac01c4ee38a1dd81d22abff36.pdf
    • https://static.usrfiles.com/ugd/b8c837_1b642fa709444dccbdd7fd3345c83fc6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065f5.bin
95cf987529dde663c9da63ac439dcfe4bac73e9440ea3dde83cfc56b113b6798		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65F5 3032 bytes
font_01_sfnt_off0000707b.bin
c1f67209d1259f6c9ef51173ddd7dd2d0c39a7ad64d308b610f1e2358f249922		 pdf-font-stream PDF embedded font (sfnt) at offset 0x707B 5068 bytes
font_02_sfnt_off000081ba.bin
9475b3055debb0cf3d3a4c970326d8b63884e31928daa31ad7b85814ce61dcf0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81BA 5064 bytes
font_03_sfnt_off00009421.bin
419e879ae506b4c36fc3fdc36850d81d08cf76285213e346b272b88bee95bdb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9421 10112 bytes
font_04_sfnt_off0000b6e8.bin
245970d7e8c29c0dcf71625f663b98fbd22e437dde4e6789e4ca4d9bdc04fd9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB6E8 16760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.