Malicious PDF — malware analysis report

Static analysis result for SHA-256 be4eda618ef36cc9…

MALICIOUS

PDF

55.3 KB Created: 2020-08-06 17:28:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1b1b8ea5142a709fb1e61ec2b6d28f00 SHA-1: 77f688f380f8d182993b50ff9856a4934d04b514 SHA-256: be4eda618ef36cc906465a402a20a97e67167a7ab3fa35c426b7be062bb1991e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous embedded links, with one specifically pointing to a known malicious redirector. The heuristic firings indicate this PDF is part of a link farm designed for SEO poisoning, aiming to trick users into downloading malicious content. The document body, though heavily obfuscated, contains URLs that are likely part of this lure. The presence of a 'Password-protected archive lure' heuristic suggests the PDF may be a precursor to delivering a password-protected archive, a common tactic to bypass security gateways.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=journal+el+khabar+pdf+2020
    • http://files.truth-is-beauty.com/uploads/1/3/2/7/132711954/f42b68394.pdf
    • http://files.taxperks.net/uploads/1/3/0/9/130969059/efd4d57902c66.pdf
    • http://files.rhythmresearchresources.net/uploads/1/3/1/6/131606127/gelizoxi-mevep-xuzumifam.pdf
    • http://files.bookcellarlwonline.com/uploads/1/3/1/8/131860787/xejapami.pdf
    • http://files.patersonprek.org/uploads/1/3/0/7/130776326/xaxixuluf.pdf
    • https://cdn.shopify.com/s/files/1/0432/2977/3982/files/unbreaking_enchantment_id.pdf
    • https://cdn.shopify.com/s/files/1/0430/9899/6889/files/nonamizemugagovu.pdf
    • https://cdn.shopify.com/s/files/1/0431/0453/4692/files/zoology_books_for_bsc_part_1_download.pdf
    • https://cdn.shopify.com/s/files/1/0429/1297/2963/files/sajikebomuxitosejewa.pdf
    • https://cdn.shopify.com/s/files/1/0429/1903/5033/files/wilimumasogiranusolosol.pdf
    • https://cdn.shopify.com/s/files/1/0437/0992/3480/files/gutimegazexumin.pdf
    • https://cdn.shopify.com/s/files/1/0431/2370/3969/files/8610280706.pdf
    • https://cdn.shopify.com/s/files/1/0433/9141/8518/files/98672736122.pdf
    • https://cdn.shopify.com/s/files/1/0431/8081/8581/files/47033411362.pdf
    • https://cdn.shopify.com/s/files/1/0434/6108/3301/files/48558690548.pdf
    • https://cdn.shopify.com/s/files/1/0432/5454/6590/files/tujojimo.pdf
    • https://cdn.shopify.com/s/files/1/0431/7826/2692/files/xetiduxuniwejop.pdf
    • https://cdn.shopify.com/s/files/1/0429/3672/9766/files/85825350510.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00009f76.bin
6816dcc797eaefe632be703626225bd7cd64350bc4c723d96550e74e72941be2		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9F76 27012 bytes
font_00_sfnt_off00006095.bin
ccb7055195a4562cdcddcbd74037c4b3208f456222d6a5329806c641f01cca1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6095 5416 bytes
font_01_sfnt_off000072f5.bin
072cf68e5813aaecdef01aacf62b907e97b5638d78d3577171754e44e5903277		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72F5 14288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.