Malicious PDF — malware analysis report

Static analysis result for SHA-256 c562e487e8a5e3cd…

MALICIOUS

PDF

41.8 KB Created: 2020-09-18 22:44:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 41b70e075f6a1b687a3f784b2c7cae23 SHA-1: 68c67087dae35c9716843e0c2e9eda93637027dc SHA-256: c562e487e8a5e3cd54f062520939f9c0bea3705f2ab3640dcf2ff6554b9f66ff
200 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains multiple invisible links, one of which redirects to a malicious domain (`ttraff.club`) that is disguised as a "Paladin leveling guide 5e roll20". This suggests a phishing or social engineering attack aimed at tricking the user into visiting a potentially harmful website. The PDF also contains a link to a CAPTCHA-themed lure, further indicating a deceptive intent. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=paladin+leveling+guide+5e+roll20
    • http://dimab.monaro.com.au/uploads/1/3/0/8/130814085/nugomow.pdf
    • http://wagef.pilgrimadventures.com/uploads/1/3/0/7/130775403/2461527.pdf
    • http://files.arvellandcompany.com/uploads/1/3/0/7/130739532/2929356.pdf
    • http://lipafe.aurorasantiago-ortiz.com/uploads/1/3/0/9/130969628/beniwubuwometixubeg.pdf
    • http://dimab.monaro.com.au/upl
    • https://cdn.shopify.com/s/files/1/0436/7525/4937/files/casos_y_ejercicios_de_auditoria_administrativa.pdf
    • https://cdn.shopify.com/s/files/1/0430/1396/3935/files/elementary_49_dressage_test_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0436/1574/8253/files/tivomoledunowuluteviw.pdf
    • https://cdn.shopify.com/s/files/1/0433/1687/1336/files/94023853071.pdf
    • https://cdn.shopify.com/s/files/1/0437/9148/3031/files/salikexitavositurelapubus.pdf
    • https://cdn.shopify.com/s/files/1/0432/5815/1072/files/3d_models_for_maya.pdf
    • https://cdn.shopify.com/s/files/1/0437/6395/7918/files/recaptcha_is_required.pdf
    • https://cdn.shopify.com/s/files/1/0434/0593/4757/files/ketomemefuliwanolimuze.pdf
    • https://cdn.shopify.com/s/files/1/0435/5601/2191/files/megunexatuf.pdf
    • https://cdn.shopify.com/s/files/1/0436/3524/5216/files/geoffrey_local_anesthesia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006701.bin
51b2481bb6e2810f4f040226b09e036d20d137dc548b18cb400f1dcec2e9a124		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6701 5272 bytes
font_01_sfnt_off00007906.bin
8c67022ee8a9182d5de1d87a5964f04c3bc46fc33558f91138cba75450aecd3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7906 9696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.