Malicious PDF — malware analysis report

Static analysis result for SHA-256 c52b32dc7b837432…

MALICIOUS

PDF

42.4 KB Created: 2020-09-18 23:12:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 21696de306d9817e747192774a995518 SHA-1: 08b814624a955e8830f82310ac6c7cdb532045c8 SHA-256: c52b32dc7b837432605d1a33d9233842a22a77c987a0cec5211b7a1fd0c68aa3
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.link/wix?keyword=is+seatgeek+reputable', suggesting a lure to a potentially malicious site. The presence of numerous PDF links further indicates a link farm designed to distribute malicious content or facilitate phishing.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=is+seatgeek+reputable
    • http://kigedusa.lindamariconda.com/uploads/1/3/1/6/131608016/d05158c163257fb.pdf
    • http://gamegopab.piercingpoli.com/uploads/1/3/1/8/131856333/2679766.pdf
    • http://files.nextgenstockton.com/uploads/1/3/1/6/131637186/7937888.pdf
    • http://rakobama.scillycottage.com/uploads/1/3/2/6/132695306/ketulepe-tosevepoj-puligivegipit-libinaleduno.pdf
    • http://files.onspotexam.com/uploads/1/3/0/9/130969371/dazif.pdf
    • https://1275ade9-501d-4c09-b26e-750dfe78a3db.filesusr.com/ugd/9117e0_799eb78087cf4fb7a7685fe674091b72.pdf?index=true
    • https://42885f3e-9e26-48a9-8de5-0f94fbc598b7.filesusr.com/ugd/c63bf9_8047932a9d49425c97a188cc77581202.pdf?index=true
    • https://8a832b6e-5c8c-401e-8273-1f406413ffa5.filesusr.com/ugd/2eec94_d092bfd600084ba3aad1bbdb887d5722.pdf?index=true
    • https://8e7bb642-5bda-455e-8117-c2b338755918.filesusr.com/ugd/e3c460_a1220a25640248d581a9e38cb995bc21.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0433/7664/0156/files/pillow_forms_walmart.pdf
    • https://cdn.shopify.com/s/files/1/0436/9511/2347/files/23661472113.pdf
    • https://cdn.shopify.com/s/files/1/0434/1386/4604/files/quest_for_camelot_songs.pdf
    • https://cdn.shopify.com/s/files/1/0436/8950/9017/files/zalatetevozevebig.pdf
    • https://cdn.shopify.com/s/files/1/0437/3905/4231/files/islamic_preschool_curriculum.pdf
    • https://217e8d7c-82bf-4e47-b4b3-cc08198c5fbb.filesusr.com/ugd/cc3ca9_26a4dbfef5ac46a7b7bf4fe41e4c37af.pdf?index=true
    • https://d1187b99-b591-4815-be1c-605f9140273a.filesusr.com/ugd/bca722_90e5a6280486406aa46ac63a22b67ca0.pdf?index=true
    • https://c6491074-2bbf-426e-98cd-7b330d115828.filesusr.com/ugd/cf79db_af47ee65a2e14617bb5771c39f786d9b.pdf?index=true
    • https://06491598-d871-4991-b54c-c3722cc1bd61.filesusr.com/ugd/c33cdb_ff02e1709e5a43878f5ccf7cb280d21e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://c6491074-2bbf-426e-98cd-7b330d115828.filesusr.com/ugd/cf79db_af47ee65a2e14617bb5771

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000663c.bin
097853e6c7d101673801a77dd6cc93a1ffbfabd57aea0e0884a2bf9d4067a02e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x663C 5128 bytes
font_01_sfnt_off000077c3.bin
be437d706a6ccefb005153b17f1ee65fe5149615346a33a1bf5f8400e7534556		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77C3 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.