Malicious PDF — malware analysis report

Static analysis result for SHA-256 df7c1b941e9da2d2…

MALICIOUS

PDF

45.1 KB Created: 2020-09-20 05:03:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd91e48dfcd72a68b5215a0956239ffd SHA-1: 7c64d56f4db07234c6ed575f8d8d67ea169bd10a SHA-256: df7c1b941e9da2d2f9480925cf8fc44aae939f9c071ae89bb14f7bf5f9939099
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF contains a mass external link farm, with one URL pointing to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to 'Everest cash advance phone number' and includes multiple embedded URLs. This suggests a callback phishing or tech-support scam pattern, where the user is prompted to call a number or visit a link under the guise of financial assistance or a refund, likely leading to credential harvesting or financial fraud.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=everest+cash+advance+phone+number
    • http://files.thewholechildmatters.org/uploads/1/3/2/7/132740564/4021894.pdf
    • http://gonir.jayanthibunyan.com/uploads/1/3/1/0/131069839/jagevataxerugego.pdf
    • http://ramewe.hisonelife.com/uploads/1/3/1/8/131856819/6331315.pdf
    • http://files.babsbeadwarehouse.com/uploads/1/3/1/0/131070166/2939725.pdf
    • http://ramewe.hisonelife.com/uploads/1/3/1/8/1
    • https://c174736c-6351-4459-a705-5efbf4d7cd02.filesusr.com/ugd/b13fd1_1dba33403f574b459664ba5c286c4c52.pdf?index=true
    • https://659ecc6d-963a-4c94-8868-204a0ddcaaa3.filesusr.com/ugd/3402b1_973ec7c6dcc8417384ab69be40e20a09.pdf?index=true
    • https://5bea9a7a-f729-426b-844b-4f8f764f737a.filesusr.com/ugd/607883_aeb8d7e9b0ac4144a726b7aad820bd84.pdf?index=true
    • https://ac6aa113-f767-4681-ad57-533927e20df9.filesusr.com/ugd/c8683e_c8e39df8b9a94e3c9ca7ffff9f61c3b1.pdf?index=true
    • https://64448114-0f6c-4f32-a8cd-f4a058e5136f.filesusr.com/ugd/1ebe14_a6d22de262294df8a55b248c9660bb2b.pdf?index=true
    • https://54ed788f-bd56-4173-ab0f-b1c7030d2fe4.filesusr.com/ugd/8da65f_ba0904babb9b45b8a6ebf727b0c6c53b.pdf?index=true
    • https://b9a5cfdd-7a68-40c8-aeec-fa24d78fca37.filesusr.com/ugd/b81754_19f0c0d2288b414d8a01fcdc5555c846.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0428/6640/9639/files/70368815595.pdf
    • https://cdn.shopify.com/s/files/1/0439/8107/8686/files/lupedevixosajufud.pdf
    • https://cdn.shopify.com/s/files/1/0432/5759/4011/files/lejusuxetexuxinon.pdf
    • https://cdn.shopify.com/s/files/1/0433/5871/6055/files/19185706728.pdf
    • https://cdn.shopify.com/s/files/1/0429/8529/1937/files/savuwamabopitukim.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f8d.bin
680ca0bf186de6f45ceb87875a0017074305cb5dbf99ade5967c6a01b01ffefd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F8D 5440 bytes
font_01_sfnt_off000081e4.bin
86ca66fa6a4e058a9aaf492ccc0ff1c313747790f2fa57be87d421c575067c77		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81E4 10952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.