Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2b9880b9bfc7662…

MALICIOUS

PDF

128.7 KB Created: 2020-07-29 09:50:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 507bc0afbb84b1762a0383d3bc17e850 SHA-1: 0ceab7fd926f9d0364463357a56b916aaa45e914 SHA-256: e2b9880b9bfc7662f0c4a0d50ad8ed8f7f5c39e09d67b89dfafa01a6f4c5eadf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it redirects to malicious infrastructure. Additionally, PDF_SEO_LINK_FARM indicates a large number of external links, with the primary one being a redirector. The document body, though heavily obfuscated, contains text related to cuneiform symbols, likely a lure to disguise the malicious redirection. No scripts were extracted from this sample.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=how+many+cuneiform+symbols+are+there
    • http://files.bedfordpolicedepartment.com/uploads/1/3/1/4/131437085/5614523.pdf
    • http://files.arnglobal.org/uploads/1/3/0/9/130969897/2b9b55659.pdf
    • http://files.cjlfinejewelry.com/uploads/1/3/1/8/131856539/wekomumeni.pdf
    • http://files.crushcop.com.au/uploads/1/3/1/3/131379380/1330043.pdf
    • http://files.eunjukang.net/uploads/1/3/0/7/130740110/205107.pdf
    • https://cdn.shopify.com/s/files/1/0430/1602/8309/files/zupebemegedijewefugowu.pdf
    • https://cdn.shopify.com/s/files/1/0433/3459/8809/files/gewavapuveguxosadolamu.pdf
    • https://cdn.shopify.com/s/files/1/0432/4071/8493/files/xupibikadelemegovotom.pdf
    • https://cdn.shopify.com/s/files/1/0431/1112/1057/files/65148948721.pdf
    • https://cdn.shopify.com/s/files/1/0433/6621/9941/files/80783869722.pdf
    • https://cdn.shopify.com/s/files/1/0427/5788/2022/files/36815586110.pdf
    • https://cdn.shopify.com/s/files/1/0440/8947/5237/files/zovebo.pdf
    • https://cdn.shopify.com/s/files/1/0432/7243/7913/files/senomip.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/49893706483.pdf
    • https://cdn.shopify.com/s/files/1/0428/2905/4118/files/98398717679.pdf
    • https://cdn.shopify.com/s/files/1/0430/8716/7641/files/xumonaxikite.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017d4b.bin
a5f17e8ed03f8a777dfb0aeca6121ad3d869630de6392ff1c4e68f68eb446e1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17D4B 5300 bytes
font_01_sfnt_off00018f29.bin
c8b8aa2c8b3f9c35ad09bcfd06c10d59ec020503784cd6462d5b9a9288fb84b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18F29 19880 bytes
font_02_sfnt_off0001c7ba.bin
0b3d5080bd0c7301eba4da71896ea2ce1156d4b11ff02881a405684f15f4dcee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C7BA 16572 bytes
font_03_sfnt_off0001de80.bin
d6418a6ccc5858a3578d6c38b3d37bcafc1e8cff7c626260c4799d97cdace39a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DE80 8428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.