Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3cb625194dcbf52…

MALICIOUS

PDF

60.1 KB Created: 2020-09-01 17:48:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 415fcf04f1724cce7e8e96fe30011130 SHA-1: 2fcc9dd963d5790135920092f944db17606e8412 SHA-256: d3cb625194dcbf52089f016fc501490f2538ad202d5c257e2be395b741b64386
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous links, identified as a link farm, with one prominent link leading to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'Adobe illustrator design templates free' and a URL that matches the malicious redirector. This suggests a social engineering attack aiming to trick users into visiting a malicious website under the guise of offering free design resources.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=adobe+illustrator+design+templates+free
    • https://cdn.shopify.com/s/files/1/0437/2050/7544/files/number_worksheets_for_preschoolers.pdf
    • https://cdn.shopify.com/s/files/1/0431/4752/6293/files/aadhaar_card_documents.pdf
    • https://cdn.shopify.com/s/files/1/0432/1011/3188/files/maronutajetep.pdf
    • https://cdn.shopify.com/s/files/1/0430/4296/3613/files/15402776124.pdf
    • https://static.usrfiles.com/ugd/35ddae_5fe0bd38b9ea4d4eb7cb6a292e9ab05b.pdf
    • https://static.usrfiles.com/ugd/ec0c41_73609b7b20d34417a3ffd67c1fd4b4c8.pdf
    • https://static.usrfiles.com/ugd/0df15e_2351d835e1f34e3789a71e1d6b053ecb.pdf
    • https://cdn.shopify.com/s/files/1/0431/6961/1932/files/bopupefogu.pdf
    • https://cdn.shopify.com/s/files/1/0430/4669/9165/files/24843026553.pdf
    • https://cdn.shopify.com/s/files/1/0430/4211/1637/files/pobevogibisuzobeme.pdf
    • https://cdn.shopify.com/s/files/1/0434/6550/6966/files/canzoniere_italiano_gratis.pdf
    • https://cdn.shopify.com/s/files/1/0440/6060/6616/files/nature_merit_badge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000adca.bin
2ee782f2630dbcb746a1e59138f473e840001994da0f5c18191ff346efadb322		 pdf-font-stream PDF embedded font (sfnt) at offset 0xADCA 5492 bytes
font_01_sfnt_off0000c059.bin
a5c7e2b34888650a42812949c570ab35e629eabaefc3bec4d124ab7f0bf01b5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC059 10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.