Malicious PDF — malware analysis report

Static analysis result for SHA-256 e87dad2dbcbcee4c…

MALICIOUS

PDF

311.5 KB Created: 2020-08-29 23:11:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d00db8374c07f1c4bef695fb15fdf746 SHA-1: 9c06d1a6538e8fcc4a535ad016a46ff5b10067b2 SHA-256: e87dad2dbcbcee4c5b8dc17295a0798d581f6d075316bd640602d967cd2ab3ec
68 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a link to a known malicious redirector, indicating an attempt to lead the user to a harmful website. The document body and metadata are obfuscated, but the presence of the malicious URL is a strong indicator of malicious intent. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' directly supports this finding.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=aashto+roadside+design+guide+2018
    • https://static.usrfiles.com/ugd/760101_ed6b0ecb140f4f499e9d66906b9ad8b8.pdf
    • https://static.usrfiles.com/ugd/a382ee_f38139672c814aa7a18915ec17cf176c.pdf
    • https://static.usrfiles.com/ugd/b8c837_005882a4fa324a5691640cd1ef84b234.pdf
    • https://static.usrfiles.com/ugd/b8c837_1a3a734cf46e429b9e3999b0607068bf.pdf
    • https://static.usrfiles.com/ugd/b8c837_ac47ebecbe044917b861c33bf9691860.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/runuwadobona.pdf
    • https://cdn.shopify.com/s/files/1/0432/4173/4311/files/historia_de_la_biotecnologia_vegetal.pdf
    • https://cdn.shopify.com/s/files/1/0431/6427/0743/files/lawumuvaguxijuvagedetag.pdf
    • https://static.usrfiles.com/ugd/b8c837_e6b032325d904897bf9cf1e87d7ac8a1.pdf
    • https://static.usrfiles.com/ugd/b8c837_83b5581846904130aa0d4c35885f5f10.pdf
    • https://static.usrfiles.com/ugd/b65acf_48946ee3fda34797a21246dcd81536ef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00048e21.bin
73edbe763df20f92f37a3b5a386a0293ba13ee32e38ff13063c121309fbef448		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48E21 5564 bytes
font_01_sfnt_off0004a105.bin
7285485c26f071348b8c88023951b8fb5c6db343d3bba3476f9d54be8a1f4161		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A105 14228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.