Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce9670c27efa5202…

MALICIOUS

PDF

42.0 KB Created: 2020-09-13 12:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe4e62c022b194ba3ca61c9f82427a13 SHA-1: be1f2d328b9c016bc5ce8e36612b4680ad0ffc43 SHA-256: ce9670c27efa5202e2b311bf12f20f086e10dad4ffa2877a3a9e4fbd8b186a9c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with a critical heuristic firing indicating a malicious redirector link and another indicating a PDF link farm. The document body, though corrupted, contains text referencing 'Sonic 2020 movie watch online' and a URL that matches the malicious redirector. This suggests the document is designed to trick users into visiting malicious sites, likely for phishing or malware delivery.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=sonic+2020+movie+watch+online
    • http://vivinojo.jennihilton.com/uploads/1/3/2/7/132712615/2460691.pdf
    • http://tajomi.catcanteri.com/uploads/1/3/1/0/131070420/be61ecf9.pdf
    • http://nuwose.surviveessentially.com/uploads/1/3/1/1/131163599/1b126de4e0d.pdf
    • http://lasat.proyecto1867.com/uploads/1/3/0/8/130814328/dabovaxuneji.pdf
    • https://cdn.shopify.com/s/files/1/0437/1143/0809/files/57163961331.pdf
    • https://cdn.shopify.com/s/files/1/0434/2025/4375/files/ancient_greece_reading_comprehension_worksheets.pdf
    • https://cdn.shopify.com/s/files/1/0457/6722/9606/files/iowa_w_4_2015.pdf
    • https://cdn.shopify.com/s/files/1/0447/9811/6006/files/apartheid_history.pdf
    • https://cdn.shopify.com/s/files/1/0437/4609/9349/files/gepodusezil.pdf
    • https://cdn.shopify.com/s/files/1/0441/3430/1848/files/platform_ajay_devgan_movie.pdf
    • https://cdn.shopify.com/s/files/1/0432/5117/1478/files/basowa.pdf
    • https://static.usrfiles.com/ugd/f6a907_170237e41ddc49b8ad0983d492a1e9ce.pdf
    • https://static.usrfiles.com/ugd/d54300_94b4db8c27dd453aacf65e54f649bc72.pdf
    • https://static.usrfiles.com/ugd/3ceeb9_f11589cfbb144494a449fbffee943a5a.pdf
    • https://static.usrfiles.com/ugd/67f5f7_abe5928f69da42abaa3ba12a5de1d584.pdf
    • https://static.usrfiles.com/ugd/c2007e_7e8df777ecde44758fefd7b966c5d5df.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006470.bin
17e8908bdd800255baa2407c5d2875820afd8c7565803841770c4610e4e28e56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6470 5292 bytes
font_01_sfnt_off00007668.bin
346caa7455dfd525fc474001bb78b4f65e72427a38cd4ac48ea49b50e5a9c8e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7668 10880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.