Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6ec6db7a67e9cc7…

MALICIOUS

PDF

47.6 KB Created: 2020-08-24 12:56:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8f03c34c11475e3eec037e12c7829cbf SHA-1: b59f040387183e81bf4b5e81641407e276674499 SHA-256: e6ec6db7a67e9cc7b5a9b543af7dd943d8d5f0fa9c90424abb5731604fb8a0b3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with one specifically pointing to a known malicious redirector. This suggests the document is designed as a link farm or to redirect users to malicious content. The presence of numerous Shopify-hosted PDF links, while some are benign, contributes to the overall SEO manipulation or redirection strategy. No scripts were extracted, limiting the analysis of direct payload delivery mechanisms.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=formation+aide+familiale+liege
    • http://files.newspapermania.com/uploads/1/3/0/7/130775180/xufojatazefi.pdf
    • http://files.ourfamilyrootsfarm.com/uploads/1/3/2/3/132303151/duriko_paniru_jilafiv_litagexig.pdf
    • https://cdn.shopify.com/s/files/1/0433/4875/4600/files/somerset_dough_sheeter.pdf
    • https://cdn.shopify.com/s/files/1/0429/9928/3863/files/45680708947.pdf
    • https://cdn.shopify.com/s/files/1/0431/3051/9703/files/automatic_reversible_dough_sheeter_machine.pdf
    • https://cdn.shopify.com/s/files/1/0443/0757/9036/files/clinical_trials_books_free_download.pdf
    • http://ruzuf.glasstire.square.site/uploads/1/3/1/1/131163992/46c6d1a03ab2.pdf
    • https://cdn.shopify.com/s/files/1/0447/9765/7248/files/75969939910.pdf
    • https://cdn.shopify.com/s/files/1/0432/0067/6003/files/58188530352.pdf
    • https://cdn.shopify.com/s/files/1/0431/7547/7414/files/bleach_brave_souls_build_guide.pdf
    • https://cdn.shopify.com/s/files/1/0431/0876/1764/files/40168653563.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/lozafawofife.pdf
    • https://cdn.shopify.com/s/files/1/0432/4527/3248/files/pofigevokovozifopesuboji.pdf
    • https://cdn.shopify.com/s/files/1/0454/3532/2526/files/12617847436.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064b5.bin
975fbe32ea217dd624d87cb93915ea5c7c79c8c70e8818fb032ae7f64eb003ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64B5 5004 bytes
font_01_sfnt_off0000759f.bin
d8c54a4d940e7daa03af225293957e5551042b557b112943b672e5ec6ddc67af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x759F 11740 bytes
font_02_sfnt_off00009a8c.bin
e5245523bd71a78e06ca3300da63f55ad096e28dd8c1a5e83e138be64f7d0aee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A8C 16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.