Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6312d08ef08ffc2…

MALICIOUS

PDF

106.5 KB Created: 2020-09-02 18:08:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58abbbb9a4fecb90b1a7d2f932b97ab4 SHA-1: 05c9767edad13c2573e47d6cb0a8f58f0e6d7afa SHA-256: d6312d08ef08ffc2757f69e818bc7c340ac7ef6a77dbf8d05bd34effbabc1449
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains the URL that is also listed in the heuristics. The presence of a link farm suggests an attempt to game search engine results for broader reach. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=types+of+composite+materials+pdf
    • https://cdn.shopify.com/s/files/1/0434/2281/0268/files/97058070407.pdf
    • https://cdn.shopify.com/s/files/1/0437/4449/3720/files/tratado_de_dermatologia_belda.pdf
    • https://cdn.shopify.com/s/files/1/0435/4637/8404/files/animoto_app_for_android.pdf
    • https://cdn.shopify.com/s/files/1/0437/0844/8919/files/3977716987.pdf
    • https://cdn.shopify.com/s/files/1/0431/5385/0528/files/mekudelo.pdf
    • https://cdn.shopify.com/s/files/1/0434/7383/0048/files/zedibugun.pdf
    • https://cdn.shopify.com/s/files/1/0441/4029/8392/files/calculate_roic_from_balance_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0431/7921/2959/files/gakimazux.pdf
    • https://cdn.shopify.com/s/files/1/0437/6884/0341/files/lulexumis.pdf
    • https://cdn.shopify.com/s/files/1/0430/3152/7575/files/navasikovutuxebiki.pdf
    • https://cdn.shopify.com/s/files/1/0437/6743/1320/files/acupuncture_arbitration_agreement_form.pdf
    • https://cdn.shopify.com/s/files/1/0433/7431/3633/files/sejusaxufilifigif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013158.bin
6a2d732cc7184cdcb8eb8ce45d4d78d9d4bd666edd662390507c2be007c2f1b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13158 5032 bytes
font_01_sfnt_off0001427c.bin
1bfb92db2537de52d3fe582a52c136f70edb5a3d1359c520f8262203a959defe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1427C 17264 bytes
font_02_sfnt_off00017884.bin
8b1f9e60c2c4c97be5ca16ce80663ffad960f1e538cf82d06d39fc1e723c44e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17884 16200 bytes
font_03_sfnt_off00018dcd.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18DCD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.