Malicious PDF — malware analysis report

Static analysis result for SHA-256 d684339b13d82e07…

MALICIOUS

PDF

64.3 KB Created: 2020-08-27 13:36:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3dd268f90afabddff4128ec629b1f645 SHA-1: c1d9a44a599a0c78a5a0b06082ffcf53e1f128d0 SHA-256: d684339b13d82e07db801f75d79a6df0848058b759aad82285af5653b6b8ab2f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically identified by the critical heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The embedded document body, though heavily obfuscated, contains the target URL which is a known redirector. The presence of numerous links to external PDFs, many hosted on Shopify, suggests a tactic to obscure the final malicious destination and potentially leverage SEO techniques for distribution.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=estimation+and+costing+pdf+nptel
    • http://gufori.forstalsiberians.org/uploads/1/3/0/8/130874601/xevireli.pdf
    • http://files.studio-pp.com/uploads/1/3/0/7/130775848/43acb59578bfb.pdf
    • http://kesalumow.turtlerecording.com/uploads/1/3/1/6/131606490/xesugeweb.pdf
    • http://firej.arborspringsbc.org/uploads/1/3/1/3/131398134/wajufafuku.pdf
    • https://cdn.shopify.com/s/files/1/0430/8982/1847/files/39868509934.pdf
    • https://cdn.shopify.com/s/files/1/0435/5656/9249/files/cursive_handwriting_worksheets_5th_grade.pdf
    • https://cdn.shopify.com/s/files/1/0447/5430/5175/files/99599634801.pdf
    • https://cdn.shopify.com/s/files/1/0431/1685/5457/files/34038792706.pdf
    • https://cdn.shopify.com/s/files/1/0432/6916/1110/files/41120469732.pdf
    • https://cdn.shopify.com/s/files/1/0434/0688/5027/files/bogonuneterinop.pdf
    • https://cdn.shopify.com/s/files/1/0432/5759/4016/files/tutivotikokepipan.pdf
    • https://cdn.shopify.com/s/files/1/0437/6431/8359/files/macports_vs_homebrew.pdf
    • https://cdn.shopify.com/s/files/1/0433/8958/3514/files/nissan_d22_workshop_manual.pdf
    • https://cdn.shopify.com/s/files/1/0433/5324/3816/files/tch_file_sang_nh.pdf
    • https://cdn.shopify.com/s/files/1/0435/9487/5039/files/writing_task_1_tips.pdf
    • https://cdn.shopify.com/s/files/1/0429/2447/4531/files/ai_football_ggo.pdf
    • https://cdn.shopify.com/s/files/1/0429/4888/6684/files/wunuruzazumunulavugimowor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000c56b.bin
88642b73dbb1b838e1679c351123eabd50c9ee14ffb428c6dde91ab60fa42b08		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC56B 19684 bytes
font_00_sfnt_off00008694.bin
4aba2bb845853324476be69e5ed1bf4ff35002942389efac2b843cac1129f0e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8694 2828 bytes
font_01_sfnt_off0000908f.bin
99faec4f4bab679ed480a21374475db2413aec22f0f99ccf11ba32876693d8ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x908F 5124 bytes
font_02_sfnt_off0000a1eb.bin
bb23a110c55904583541eb8261b90a1369c4306ae52610a76c80e456630d7bee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1EB 10412 bytes
font_04_sfnt_off0000e525.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE525 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.