Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5e188e099a812b5…

MALICIOUS

PDF

50.6 KB Created: 2020-08-17 00:29:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82cb898e0869cda28ce579a75508add2 SHA-1: 95713d409caa855208d2865a5e9669e239bbfaac SHA-256: c5e188e099a812b5e3a730bbeb75777141d491ecbcd14e55e7b1e87beb8d83e0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm and a critical heuristic firing for a malicious redirector. The embedded URL points to a redirector that ultimately leads to a page related to 'ncert history book class 8 answers', suggesting a lure for educational material. The redirector URL is a primary indicator of malicious intent, likely leading to a phishing or malware distribution site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=ncert+history+book+class+8+answers
    • http://files.larsenhusby.com/uploads/1/3/1/4/131453453/lularunisawaji.pdf
    • https://cdn.shopify.com/s/files/1/0437/0441/8459/files/gebaxopinodijep.pdf
    • https://cdn.shopify.com/s/files/1/0433/8309/5459/files/79375556545.pdf
    • https://cdn.shopify.com/s/files/1/0432/3262/4797/files/38160764539.pdf
    • https://cdn.shopify.com/s/files/1/0433/2371/9845/files/biladipikugibuxukoxap.pdf
    • https://cdn.shopify.com/s/files/1/0437/7794/9848/files/understanding_analysis_abbott_2nd_edition_solutions.pdf
    • https://cdn.shopify.com/s/files/1/0431/8353/8331/files/carbohydrates_notes.pdf
    • https://cdn.shopify.com/s/files/1/0429/8987/9459/files/usa_volleyball_score_sheet_instructions.pdf
    • https://cdn.shopify.com/s/files/1/0428/5733/2895/files/african_american_women_s_writing.pdf
    • https://cdn.shopify.com/s/files/1/0431/0607/4780/files/xewebewofa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063af.bin
c60cdbbd8f6196c4e3d8fd0bddb2fda13033832f6e547ad84bd5b428bb9be129		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63AF 5236 bytes
font_01_sfnt_off00007580.bin
491360591aa6f91edd751221a9162101e5393966a27b5038369d0ea7e466da26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7580 10372 bytes
font_02_sfnt_off000098c8.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98C8 4324 bytes
font_03_sfnt_off0000a6c9.bin
8e791cd8f5c45dfbfcabdd69ca91b175cfb8f74b6d39506fdb05c1fa3a8469e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA6C9 6320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.