Malicious PDF — malware analysis report

Static analysis result for SHA-256 e13ce8c8b6c7303d…

MALICIOUS

PDF

43.5 KB Created: 2020-09-07 16:16:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 60df7d5539a647eaca16f040333e3741 SHA-1: 5f60018d36ca1c30f66f3334198d0f4954ce1dff SHA-256: e13ce8c8b6c7303d6a8fa131f0b4cc62fa27edae6b61ce3cb5f229f14a6aa802
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to a malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text that appears to be song lyrics, likely serving as a lure. The PDF also hosts a link farm pointing to multiple other PDFs, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary IOC is the initial redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=man+ye+behka+re+behka+song
    • https://cdn.shopify.com/s/files/1/0428/9419/6902/files/45280708445.pdf
    • https://cdn.shopify.com/s/files/1/0430/2556/3799/files/fobeloxuxi.pdf
    • https://cdn.shopify.com/s/files/1/0434/9139/3698/files/72317292307.pdf
    • https://cdn.shopify.com/s/files/1/0430/0469/0581/files/3381937608.pdf
    • https://cdn.shopify.com/s/files/1/0431/2717/7365/files/newupuxozujuvop.pdf
    • https://static.usrfiles.com/ugd/1c90dc_af54782111074e40b50ac5434f124863.pdf
    • https://static.usrfiles.com/ugd/f103bb_b55e6eb7e78d47f59884d30de9ee438f.pdf
    • https://static.usrfiles.com/ugd/7a11b0_a86edcf7d3b343b6a550d4bf78b2c640.pdf
    • https://static.usrfiles.com/ugd/ce14f3_704fab9ecaae415e92433d8f54638895.pdf
    • https://static.usrfiles.com/ugd/43d598_dea6057ad23a426683ab0b2c73719d19.pdf
    • https://static.usrfiles.com/ugd/ae15ca_9ef80702adb74c489c977836fe245e10.pdf
    • https://static.usrfiles.com/ugd/ef7b09_a51cc587e67147aeaf8f64d7defbd241.pdf
    • https://static.usrfiles.com/ugd/e3ed1f_b3208682a9f14da7a398612d6b2f9ac1.pdf
    • https://cdn.shopify.com/s/files/1/0429/1562/7175/files/mubuxapelukujomop.pdf
    • https://cdn.shopify.com/s/files/1/0435/7505/0395/files/pajomeretakafukozefig.pdf
    • https://cdn.shopify.com/s/files/1/0433/5838/8374/files/95986221860.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005056.bin
bd0824fe30c3830fad47b1b6b860fae26376ddf423eb60622a7da8d149ab4a85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5056 5228 bytes
font_01_sfnt_off0000622f.bin
a4e5a52c63f5fb8f1c9e323678e72fdf0b0c689efbfcbba9675982c029a8c59a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x622F 13732 bytes
font_02_sfnt_off00008cae.bin
3ced29ee42526efdf9c4f095c7cef5f1a3c8383d925c403700c3d93bef88dfaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CAE 5076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.