Malicious PDF — malware analysis report

Static analysis result for SHA-256 d478d0cb54cc1d2c…

MALICIOUS

PDF

44.1 KB Created: 2020-07-10 12:20:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 72fb572ab941e51bbfe76b7ce4cdaced SHA-1: de57ad8ba5cfd80752ebe9e58b8929990484757e SHA-256: d478d0cb54cc1d2c0a85482f37535360b4e96cff5a4234ed080c7955ee6e01c7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of embedded links, many of which point to external PDF files hosted on various domains. The primary link redirects to a malicious URL, suggesting a phishing or malware distribution attempt. The document body itself is minimal, containing only a title and the embedded URLs, reinforcing the idea that its purpose is to drive users to external, potentially harmful, content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wb?keyword=alberta%20education%20funding%20manual%202019-20
    • http://files.globalisationandcities.com/uploads/1/3/1/6/131607174/jilaxafufusekiw.pdf
    • http://files.cozykidsembroidery.com/uploads/1/3/1/4/131409170/ninebafakafekip.pdf
    • http://files.kakapocakes.com/uploads/1/3/0/8/130813307/017e8771.pdf
    • http://files.frministries4u.com/uploads/1/3/1/3/131398164/2040589.pdf
    • http://files.makwawamalawi.com/uploads/1/3/2/7/132740860/zuder.pdf
    • http://files.heightsdeca.com/uploads/1/3/0/7/130776001/fetofo.pdf
    • http://files.peakhealthcaremaryland.com/uploads/1/3/1/4/131406816/rizapisopasiraluzoga.pdf
    • http://files.leisurewatercraft.com/uploads/1/3/1/3/131384559/3576006.pdf
    • http://files.surfergirlus.com/uploads/1/3/1/3/131398252/7e768005673e.pdf
    • https://jelazep.files.wordpress.com/2020/06/73584790981.pdf
    • https://zawamibidixa.files.wordpress.com/2020/06/58943016539.pdf
    • https://panujazobafe.files.wordpress.com/2020/06/xidakopumirebejejegog.pdf
    • https://wavixode.files.wordpress.com/2020/07/jujaxe.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/16946396068.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/dipudakafadaned.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/88406012193.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/58933331969.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/81159011373.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nofalefupipalivudekim.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/28650507632.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065f5.bin
17164b2623a56e31af182282535bc781096997cfa4676c7d56fe5005e7933e17
pdf-font-stream PDF embedded font (sfnt) at offset 0x65F5 5688 bytes
font_01_sfnt_off00007938.bin
d398ee86d4e1e2910116c78e37875f2df7bfc1616a77a0b1301ddcecd3a41bb1
pdf-font-stream PDF embedded font (sfnt) at offset 0x7938 13364 bytes