Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6f793736b1cffc8…

MALICIOUS

PDF

129.9 KB Created: 2020-09-07 15:39:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1340edb5fc235f0d9db2dc8c3208da1b SHA-1: 6cf4c93fb48f225a257088351aa9d076a17440bc SHA-256: e6f793736b1cffc8349396e1b9ec1a7dc66a65ff3ca9ff8f510836ab0ec80198
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous links, a common tactic for SEO poisoning or redirecting users to malicious sites. One critical heuristic indicates a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector. This suggests the PDF is designed to trick users into clicking the link, likely leading to a scam or further malware delivery.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=beauty+and+the+beast++2017
    • https://cdn.shopify.com/s/files/1/0440/7010/9334/files/love_affair_1994_full_movie_free.pdf
    • https://cdn.shopify.com/s/files/1/0433/4849/2438/files/dugezebumetexate.pdf
    • https://cdn.shopify.com/s/files/1/0434/2756/1634/files/jajelavetebiluvikod.pdf
    • https://static.usrfiles.com/ugd/0dd040_8bcdce42a1b540f7a7e6dac0a79ef434.pdf
    • https://static.usrfiles.com/ugd/0adedf_167b8978ed4240d9a0ef5eca29b838d7.pdf
    • https://static.usrfiles.com/ugd/12f4eb_9450e4a915414c72af8a4d14e22d11dc.pdf
    • https://static.usrfiles.com/ugd/b914b5_39a675a874ce4de0acda6da6e768ad9b.pdf
    • https://static.usrfiles.com/ugd/bcd086_70d0bb881b034fa6b19a42114dd76d4b.pdf
    • https://static.usrfiles.com/ugd/754d94_8057cca7f4424f85abe80b429e99735f.pdf
    • https://static.usrfiles.com/ugd/906e9f_37c370038cf84f82840a7a75fda81f66.pdf
    • https://static.usrfiles.com/ugd/edb4a7_f34d4e3114bb4eee82993f7c808d2d2e.pdf
    • https://static.usrfiles.com/ugd/205ae4_98501924a8f4405a86983cfa3ad0cac2.pdf
    • https://static.usrfiles.com/ugd/b8c837_ed579ad385854d5c88d434ac03084648.pdf
    • https://static.usrfiles.com/ugd/aaaf79_60dac23d46a84c73a533ef17ac8a4ef1.pdf
    • https://static.usrfiles.com/ugd/c3548c_360558a1e88747778202de37ed95f593.pdf
    • https://static.usrfiles.com/ugd/f4de5e_427d38b4fdf846379bc4adb246b64bae.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a015.bin
db3749cdf588f4d4ac93edaab3e7ff0b34e0f764946bbff68863203ab5788ec4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A015 5484 bytes
font_01_sfnt_off0001b2c0.bin
9955be659735df9034fd00ad9d64280f6503b6a02db8edde50d175952318a6df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B2C0 2320 bytes
font_02_sfnt_off0001bd31.bin
e9e282427dd56065e7950df0746e008de8f507c885c4e279124b330d22e8a879		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BD31 11200 bytes
font_03_sfnt_off0001e3b8.bin
0f067139dfbcfc6dcacda41a9fcdfc88809a746abe1c9926449aa65740dadf3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E3B8 16304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.