Malicious PDF — malware analysis report

Static analysis result for SHA-256 e75258e57161924a…

MALICIOUS

PDF

41.1 KB Created: 2020-08-28 14:19:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 525c102e9b241bf673ea6c30894b2338 SHA-1: d3506f729300c3b084255544d5e6caa485c1c516 SHA-256: e75258e57161924a597316abfe5feb3c0192f8d8d833899d2bac5de6c5a82d24
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, a technique often used to redirect users to malicious sites. One critical heuristic identified a link to known malicious redirector infrastructure at 'https://ttraff.ru/pify?keyword=como+hacer+un+poster+en+publisher+2016'. Another heuristic flagged the document as a PDF link farm, containing 16 external PDF links, many hosted on shopify.com, suggesting an attempt to manipulate search engine results or distribute further malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=como+hacer+un+poster+en+publisher+2016
    • http://gepej.yogadiversityinitiative.org/uploads/1/3/1/4/131437261/laroli_pezogijavamu.pdf
    • http://xifebi.mindspringhempco.com/uploads/1/3/1/0/131070858/b69b0a202.pdf
    • http://files.curacao-vakantievilla.com/uploads/1/3/0/7/130776445/b5ba4.pdf
    • http://mawepus.cometboosterclub.com/uploads/1/3/0/7/130739602/2901478.pdf
    • http://files.backbonesports.com/uploads/1/3/0/7/130739718/1934647.pdf
    • https://cdn.shopify.com/s/files/1/0431/4130/0380/files/insulated_cookie_sheet_walmart.pdf
    • https://cdn.shopify.com/s/files/1/0430/8520/1561/files/pevumoremiveregeti.pdf
    • https://cdn.shopify.com/s/files/1/0437/7031/4903/files/manual_prctico_de_biomagnetismo_holstico.pdf
    • https://cdn.shopify.com/s/files/1/0438/5934/5573/files/battlefield_3_servers.pdf
    • https://cdn.shopify.com/s/files/1/0436/8033/3989/files/vinuja.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/55497749658.pdf
    • https://cdn.shopify.com/s/files/1/0431/7147/9713/files/jebozamubegozobamosineno.pdf
    • https://cdn.shopify.com/s/files/1/0434/5564/3813/files/wesamuwalojofipux.pdf
    • https://cdn.shopify.com/s/files/1/0432/1312/7835/files/nulofuderivoditovatilofet.pdf
    • https://cdn.shopify.com/s/files/1/0427/8976/5276/files/21083231748.pdf
    • https://cdn.shopify.com/s/files/1/0434/8346/3832/files/86686746584.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000060bb.bin
81daceb9d435c82b56a7029b8123b1dfd145ca690c5cf1c6f335b07bbe7f21e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60BB 5700 bytes
font_01_sfnt_off000073f5.bin
bb7d359116a739091e8e5165e4eea6445567da3a73f200fbf78ec82d44fc9fe2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73F5 10320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.