Malicious PDF — malware analysis report

Static analysis result for SHA-256 d53d94f776d8c401…

MALICIOUS

PDF

96.9 KB Created: 2020-08-23 02:59:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7eff8392becfa4502744966eb8754245 SHA-1: c071f3cb9bc185ec4743cb70cbdeb71f023300f7 SHA-256: d53d94f776d8c4019d0e048fbfcd1852172170e8d6fffacdf45cb456ccc7c15e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the redirector link found in the heuristics. This suggests the document is designed to redirect users to malicious infrastructure, likely for phishing or to download further malware. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=aoc+q3279vwf+manual
    • http://simona.americancatalyst.org/uploads/1/3/0/8/130814851/e316411bffb8.pdf
    • http://wivupafel.fatherbrowning.com/uploads/1/3/1/8/131856331/4826230.pdf
    • http://files.borekg.com/uploads/1/3/1/4/131438056/71ab13b4525db.pdf
    • http://gujavopo.donthesitate.org/uploads/1/3/2/7/132740405/sajerekebufojinav.pdf
    • https://cdn.shopify.com/s/files/1/0429/6006/0567/files/xafenomelos.pdf
    • https://cdn.shopify.com/s/files/1/0432/4704/2715/files/the_addams_family_musical_score.pdf
    • https://cdn.shopify.com/s/files/1/0431/2429/3794/files/jipumajimubexaf.pdf
    • https://cdn.shopify.com/s/files/1/0432/9550/6592/files/21087434616.pdf
    • https://cdn.shopify.com/s/files/1/0439/5266/8830/files/22619121386.pdf
    • https://cdn.shopify.com/s/files/1/0434/4040/6684/files/initiative_referendum_and_recall_worksheet_answers.pdf
    • https://cdn.shopify.com/s/files/1/0430/1324/3033/files/red_scarf_girl_summary.pdf
    • https://cdn.shopify.com/s/files/1/0432/7515/7670/files/ganivififezusuwevakag.pdf
    • https://cdn.shopify.com/s/files/1/0440/6090/1528/files/duwenuxetefawiwipavalozi.pdf
    • https://cdn.shopify.com/s/files/1/0429/6055/2085/files/pumpkin_carving_stencils.pdf
    • https://cdn.shopify.com/s/files/1/0450/2241/2958/files/abdomen_agudo_cirugia_pediatrica.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001304d.bin
5f506f96885c68285abb08013964e969243e5a1cdb180af6bb27fe8127c8fd8a
pdf-font-stream PDF embedded font (sfnt) at offset 0x1304D 3724 bytes
font_01_sfnt_off00013d8a.bin
c908061a965b4d5a1767baee048563a8bd25c09dbc45e6d1a582055f9e3946c8
pdf-font-stream PDF embedded font (sfnt) at offset 0x13D8A 5552 bytes
font_02_sfnt_off00015075.bin
b053555d242434462efafaa9922296584b12f947f78af28e574fe8ef080a7b0f
pdf-font-stream PDF embedded font (sfnt) at offset 0x15075 11076 bytes