Malicious PDF — malware analysis report

Static analysis result for SHA-256 c47c11be6e66b4fa…

MALICIOUS

PDF

47.9 KB Created: 2020-09-05 09:03:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ea4942a69e7093af2817f4563314193 SHA-1: 34fe0c2973b429bd91c25c1665b750f8a826de3a SHA-256: c47c11be6e66b4fac5d0a3776801c540d5a08ddd59f55b82db15f50dc23a9dac
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, which is further supported by the presence of a link farm. The document body, though heavily obfuscated, contains text related to 'burn iso to usb software free' and the malicious URL. This suggests a social engineering tactic to trick users into clicking the link, likely leading to further malicious activity.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=burn+iso+to+usb+software+free
    • https://cdn.shopify.com/s/files/1/0432/7286/3904/files/lakuf.pdf
    • https://cdn.shopify.com/s/files/1/0433/4020/2142/files/79703933944.pdf
    • https://cdn.shopify.com/s/files/1/0435/2730/7423/files/andra_and_the_backbone_lagu.pdf
    • https://static.usrfiles.com/ugd/3254bf_20747b5094944dfa8d5e5e0859041e2b.pdf
    • https://static.usrfiles.com/ugd/f3ecbe_90750a7b9cda4651b727d48efde4f1bf.pdf
    • https://static.usrfiles.com/ugd/b8c837_e37f0d60dca64d2186135b4c078352fe.pdf
    • https://static.usrfiles.com/ugd/9374a7_b7f562cbcb284b01b0379e23bd6f1652.pdf
    • https://static.usrfiles.com/ugd/b8c837_25449e10606b4d90bb17b4753bd07f7f.pdf
    • https://static.usrfiles.com/ugd/ea5d7b_69a2e06002274b9d9570cdde56a70d85.pdf
    • https://static.usrfiles.com/ugd/409ca8_7837e894a4a947478374107735d52303.pdf
    • https://static.usrfiles.com/ugd/5ad03d_98f9c36c4b774bb794d8c14861c8687f.pdf
    • https://static.usrfiles.com/ugd/b8c837_16ebe99b704746ec9d98455de98a22e5.pdf
    • https://cdn.shopify.com/s/files/1/0434/2664/4119/files/us_polo_assn_watch_sr626sw_manual.pdf
    • https://cdn.shopify.com/s/files/1/0461/8249/8467/files/a4_bifold_brochure_mockup_psd_free.pdf
    • https://cdn.shopify.com/s/files/1/0432/3000/3358/files/teamviewer_9_for_android_mobile.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fbd.bin
934a2eddd2de1617473e2987d97eb95e68d21992c5f2f6d85e8286c73b0362c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FBD 4892 bytes
font_01_sfnt_off00008079.bin
3fab17f9709b4432de1a269264d2350d5a5f9546237823f6947ae16cd247c1cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8079 10620 bytes
font_02_sfnt_off0000a4ab.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4AB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.