Malicious PDF — malware analysis report

Static analysis result for SHA-256 ced7da88ad5259d2…

MALICIOUS

PDF

44.3 KB Created: 2020-10-07 14:06:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90a6cb92e3469254ea5785e56407b9ad SHA-1: 8351b31ea70ddfa3eb3077507b7e8ccdf2968738 SHA-256: ced7da88ad5259d24ba6dc8872610ec4724dedbc94d50d4d8932378cd1abb959
68 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 Malicious Link

The PDF file contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains the same URL found in the heuristic, suggesting an attempt to trick the user into clicking it. The presence of urgency language further supports a social engineering attack pattern. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=are+autopsies+public+record+in+california
    • http://kitemudan.collegehillpc.org/uploads/1/3/1/0/131069921/cbacd2b06a82a5a.pdf
    • http://pezomim.thankgodforsex.org/uploads/1/3/1/4/131408027/6782213.pdf
    • http://files.cmcridgewater.org/uploads/1/3/2/6/132681450/zubevoguduradu_giborel.pdf
    • https://cdn.shopify.com/s/files/1/0428/5949/5590/files/animal_farm_in_spanish.pdf
    • https://cdn.shopify.com/s/files/1/0430/8716/7645/files/73836141937.pdf
    • https://cdn.shopify.com/s/files/1/0432/3452/5352/files/vivapotitel.pdf
    • https://uploads.strikinglycdn.com/files/c6ac25e8-5738-432c-80f3-4661bb62156f/97738958521.pdf
    • https://uploads.strikinglycdn.com/files/513fea5d-934e-476e-8676-4ec1c3ee79f3/denabi.pdf
    • https://uploads.strikinglycdn.com/files/9a086eaf-d15e-43d4-8c7d-e859804bcd8d/26461311934.pdf
    • https://uploads.strikinglycdn.com/files/31370a61-e0aa-4826-b068-744dd1e18974/fiwuzisizume.pdf
    • https://uploads.strikinglycdn.com/files/9c4fdef2-ea0b-44e0-8ed1-883cd1f5f3dc/47372691118.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f88.bin
232645c77fc1c695ade8be346af6192f448423fae384b2a0bd2d3092fae80f94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F88 5276 bytes
font_01_sfnt_off00008182.bin
e5b5dae447f033371b3322bd645aa4f0311fdfd2e4fa59a5fce6482b379c5317		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8182 10312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.