Malicious PDF — malware analysis report

Static analysis result for SHA-256 c39c95608b0a26a9…

MALICIOUS

PDF

54.0 KB Created: 2020-09-17 03:42:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 025e7bdd4c303284f3aee891f7aa5782 SHA-1: 407a7d456c9f1c2d82c7109ee36a93aeedef35ce SHA-256: c39c95608b0a26a9ca2930982417710e236eefe20b75f11d95ae3e578b0f3192
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to a URL associated with 'raid shadow legends apk mod'. The document body, though heavily obfuscated, also contains this URL, suggesting a lure to download a modified application. Another critical heuristic indicates a PDF link farm, further supporting the malicious intent of redirecting users to external content. The presence of a 'download button' heuristic reinforces the social engineering aspect of this attack.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=raid+shadow+legends+apk+mod+1.13.2
    • http://jizusa.precisiondiecutting.com/uploads/1/3/1/4/131454436/kuvipexagox_pugifiduxevofom_dokizere_nufojutibo.pdf
    • http://files.elernenmuzik.net/uploads/1/3/0/7/130776521/topixipobetawas-faletiletawited.pdf
    • http://files.eternallyboard.com/uploads/1/3/1/4/131406735/waxiwadosakovivir.pdf
    • https://c4428d52-8f57-498f-8ff9-5cacb82ee6b6.filesusr.com/ugd/197ed4_9956d51f355f4023b596ddf3cfa73930.pdf?index=true
    • https://c04147ec-e5fd-4e5c-b569-473b83af4e1f.filesusr.com/ugd/e1c37d_a676436b54aa4844a5e774e596493d4d.pdf?index=true
    • https://c2b1be19-e5c8-4b62-84e4-f88b6013676e.filesusr.com/ugd/a3b54b_a9ef5b51731b430199049e52181b65d9.pdf?index=true
    • https://067b5a80-b0dc-49ef-9cfd-f7fa2547557c.filesusr.com/ugd/e948c1_a602e33c8ccf49c6a35c94f0b0f0bbbe.pdf?index=true
    • https://48dbb662-d525-4fb3-b921-ebc8edb568e7.filesusr.com/ugd/d4df0f_056c0f2a15c144cab0024a4e04350252.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0432/3485/3021/files/gekutazomitume.pdf
    • https://cdn.shopify.com/s/files/1/0438/4774/5698/files/7482240147.pdf
    • https://cdn.shopify.com/s/files/1/0429/3813/8783/files/agario_hack_coins_and_dna.pdf
    • https://cdn.shopify.com/s/files/1/0431/1898/5370/files/colonisation_game_android.pdf
    • https://cdn.shopify.com/s/files/1/0432/7197/9171/files/63783339943.pdf
    • https://edee2c22-466b-4b6d-9c2c-039f9a52fb2c.filesusr.com/ugd/defcb2_74be114442ac4d48ad21596ffe630fda.pdf?index=true
    • https://df2876b9-0a4c-4784-b812-37fa2d936bd9.filesusr.com/ugd/02beb7_d5732d54bc18438e941922482f48f3c8.pdf?index=true
    • https://f55acf91-8b5c-4e68-a2e4-e03be563b868.filesusr.com/ugd/8f6098_91f92c9be4804fdca6bf86410ae47078.pdf?index=true
    • https://a4bdf3a7-c796-4a38-bf58-b79d8279efe1.filesusr.com/ugd/9c66ff_87d11aa415a64dce95d4b3f8802e3826.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000711e.bin
ffe416b057414c22b75fbd6c2136995586998530024b7f0398dbe09c3b22dfd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x711E 5528 bytes
font_01_sfnt_off000083d6.bin
545c76494f98bacb1b0d6e8666bad1f8fe585971d3687f10c5a265c2c8e327dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83D6 10328 bytes
font_02_sfnt_off0000a76c.bin
8a6fe2d22476d7d52c2a2b499370b40629d1cec4bbb8fd01fa40e8e9fdb20871		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA76C 16144 bytes
font_03_sfnt_off0000bc58.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBC58 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.