Malicious PDF — malware analysis report

Static analysis result for SHA-256 e40f5f73605431fb…

MALICIOUS

PDF

53.9 KB Created: 2020-08-30 08:05:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 039df37123d8b382eb54e73f3fc09581 SHA-1: 83801b7fe81760273de693e86d0f4fe4f05e7dc1 SHA-256: e40f5f73605431fbd13d3d18a1f149552eff0c2aa31d7e34360470f48888be6c
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/wix?keyword=contoh+soal+tkb+agama+islam+pdf'. It also exhibits characteristics of a PDF SEO link farm, embedding numerous external links, with 'https://static.usrfiles.com/ugd/b8c837_432cfe9ff0eb48fca92d68034e3bf6a2.pdf' being a prominent example. The document body, though heavily obfuscated, contains text related to search terms and the wkhtmltopdf application, suggesting a lure to disguise malicious links as search results. The presence of a callback lure heuristic further supports a phishing or scam pretext.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=contoh+soal+tkb+agama+islam+pdf
    • https://static.usrfiles.com/ugd/b8c837_432cfe9ff0eb48fca92d68034e3bf6a2.pdf
    • https://static.usrfiles.com/ugd/eb5a6a_c49ed5cc013b47b49fc9534fc76272cb.pdf
    • https://static.usrfiles.com/ugd/a31856_de7483846fde4fed805e46e76eddaeb7.pdf
    • https://static.usrfiles.com/ugd/b8c837_b773e220c0374784937e1a949d98038a.pdf
    • https://static.usrfiles.com/ugd/eed56f_fa23957d526442be95c0947b5feccc4a.pdf
    • https://cdn.shopify.com/s/files/1/0431/0204/4316/files/rental_bond_lodgement_form.pdf
    • https://cdn.shopify.com/s/files/1/0434/1802/6142/files/pefuxosa.pdf
    • https://cdn.shopify.com/s/files/1/0463/1691/2800/files/10._4_fission_and_fusion_worksheet_answers.pdf
    • https://static.usrfiles.com/ugd/b8c837_2f09115c31ba43d1998f27242f01d6c4.pdf
    • https://static.usrfiles.com/ugd/b8c837_80d801aaee1948f588f258b845f024c8.pdf
    • https://static.usrfiles.com/ugd/23e9be_f297e8a335764dfab3ad2f54ea793b86.pdf
    • https://static.usrfiles.com/ugd/b8c837_58416ba2f78a4895bab5a49beefad802.pdf
    • https://static.usrfiles.com/ugd/b8c837_87ff230440ec41aead78420c6236ddc1.pdf
    • https://static.usrfiles.com/ugd/d2751c_1a59078ea62d4b139d41e84556527ee5.pdf
    • https://static.usrfiles.com/ugd/b8c837_2e0839b1a2534d9abba6fd66bce1cfb6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000093d1.bin
05253cc0bc3ed458327f2ccdc694783dfa4208b2dd8062f7ce89e5bafb772360
pdf-font-stream PDF embedded font (sfnt) at offset 0x93D1 5468 bytes
font_01_sfnt_off0000a63c.bin
fb5002ab0d325e664a5e86872938ed9a0711ac198c0197f42fc725abce46c044
pdf-font-stream PDF embedded font (sfnt) at offset 0xA63C 10752 bytes