Malicious PDF — malware analysis report

Static analysis result for SHA-256 e08b9bd792745a12…

MALICIOUS

PDF

68.1 KB Created: 2020-08-23 15:20:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50fcd11f62c17f74e2cf96c803f736db SHA-1: 31a2d5a1101e85d5312d99b1cda8f662189b4e30 SHA-256: e08b9bd792745a129ca561fee1cba740545f7a4f38c5b787c7d23542ebb660c1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm and a direct link to a known malicious redirector, indicating a phishing or scam attempt. The document body, though heavily obfuscated, contains the primary malicious URL. The presence of numerous embedded URLs, many pointing to external PDF files, suggests a link farm designed to improve search engine ranking for malicious content or to distribute further malicious links. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=gunbreaker+guide+the+balance
    • http://milota.hcnextdesign.com/uploads/1/3/0/8/130814706/gipaz_jabeviko_fuzuwovepup_ligokefupuna.pdf
    • http://fakolonom.kapakapatrail.com/uploads/1/3/2/6/132681670/jaxelemutetavi.pdf
    • http://vaneja.aretemediaacademy.com/uploads/1/3/0/8/130874493/2549657.pdf
    • http://dudur.mayraaustinbusinesssolutions.com/uploads/1/3/2/8/132814964/nemusan-votuwil-pesasugogome.pdf
    • http://files.foxoildrilling.com/uploads/1/3/1/3/131398560/ab2a0.pdf
    • https://cdn.shopify.com/s/files/1/0430/3316/5986/files/29426817789.pdf
    • https://cdn.shopify.com/s/files/1/0431/4526/5312/files/64981183220.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/tevedizulav.pdf
    • https://cdn.shopify.com/s/files/1/0434/6337/7048/files/58629228260.pdf
    • https://cdn.shopify.com/s/files/1/0435/0754/8326/files/romagujoziwusejaxofof.pdf
    • https://cdn.shopify.com/s/files/1/0433/3761/3466/files/numeros_cardinales_en_ingles.pdf
    • https://cdn.shopify.com/s/files/1/0428/7663/3247/files/nofanilufogafiponutarevig.pdf
    • https://cdn.shopify.com/s/files/1/0437/6884/0353/files/dp_animation_maker_with_serial_key.pdf
    • https://cdn.shopify.com/s/files/1/0439/9579/1518/files/21456137063.pdf
    • https://cdn.shopify.com/s/files/1/0431/4651/0504/files/buzekupugoloveni.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/xakikalimakimoxe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000097bc.bin
1a37f908db06cd1569170415c1a8d9834dc66923c82a2e6ee5e8b861be2afb37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x97BC 5020 bytes
font_01_sfnt_off0000a937.bin
aeefae4358109bb27b8973d0d1e78af7a83241952eb9f369a9c080c517bb86ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA937 5028 bytes
font_02_sfnt_off0000ba47.bin
68e09400a12af244da1a643e1df0b1d6963e25c66af0ea73c778e5d9b84cf5b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBA47 10928 bytes
font_03_sfnt_off0000dfa5.bin
17dc25ffd8be9e1a817a2a629234721e3af5b7f595c0e59e7e7d47d96463b6cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFA5 16076 bytes
font_04_sfnt_off0000f44f.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF44F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.