Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb060b7c95536232…

MALICIOUS

PDF

39.2 KB Created: 2020-09-18 05:58:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 83baae4766b6e7bce7186763090156a8 SHA-1: 6ca3a0ac64f9219daa151ce39ff667c30965c5bf SHA-256: eb060b7c955362324034f83142c95f70ae7bfb6916fc8dd5052fda30298ca897
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=tube+jumpers+unblocked+77'. Additionally, it exhibits a PDF link farm heuristic, with numerous links to external PDFs, including 'http://pedibafa.buysanfordrealestate.com/uploads/1/3/1/4/131483281/metozerababigivexipa.pdf'. The document body, though heavily obfuscated, contains text related to 'tube jumpers' and the malicious URL, suggesting a lure to a potentially malicious site.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=tube+jumpers+unblocked+77
    • http://pedibafa.buysanfordrealestate.com/uploads/1/3/1/4/131483281/metozerababigivexipa.pdf
    • http://files.miguelchanonafotografo.com/uploads/1/3/1/3/131383743/vusizalaxajowat-laganebis-zovokinex-lavusuba.pdf
    • http://rokaxapel.wonderfullymadebirthdoula.com/uploads/1/3/0/7/130738721/xevave_voxoxumalix.pdf
    • http://files.westvalleyfamilies.com/uploads/1/3/0/8/130813834/pitepegixusedanug.pdf
    • http://toregajav.emileegracephoto.com/uploads/1/3/0/7/130739783/9901675.pdf
    • http://motam.just-beachy.com/uploads/1/3/0/8/130874370/45837.pdf
    • https://53142d7a-40d4-
    • https://176c33b3-f834-4384-850b-f750f8e20698.filesusr.com/ugd/8c7d07_13150a68b3014518a8c698569f3ba83d.pdf?index=true
    • https://5ac46288-3057-47f9-93cb-f9116e779109.filesusr.com/ugd/aef5b7_e245803b8b1c4bb48c9706064273bbf9.pdf?index=true
    • https://4b4e12c4-1fa1-40a9-9578-6b888dd4b1e2.filesusr.com/ugd/2ca22b_77d68621986543169a1e3389b1a3611e.pdf?index=true
    • https://f4a6180a-aab9-48bc-948c-ee5c26885519.filesusr.com/ugd/3d0627_dde20bad57e94bfeb6cbdf13ef76f0f0.pdf?index=true
    • https://24ca90dc-5fa6-4037-a2b8-edce28025413.filesusr.com/ugd/289c5e_440186406d214f3fab68bd915c3c9ce9.pdf?index=true
    • https://420e28b2-fd02-41cf-88b4-e41dc10b4442.filesusr.com/ugd/c4ccc4_adc0b720719b42beb49185f985b719e0.pdf?index=true
    • https://e2c5fe7c-2755-4cf0-892f-2222953ae18e.filesusr.com/ugd/64f9d2_f89ec9cda4344a7d8af1b59836a0641d.pdf?index=true
    • https://b91e550d-5cdd-4a6f-bd9e-69936f1a8a54.filesusr.com/ugd/0a51c1_7114ff511e9149e09b88c6f6826810ef.pdf?index=true
    • https://53142d7a-40d4-4dfd-ba04-9c69a99f343c.filesusr.com/ugd/fb5067_a0de79194273478d8a725f93705f02a3.pdf?index=true
    • https://dc5f796f-6594-4b84-9ce0-b3093aaecdf5.filesusr.com/ugd/ad2ade_3e19b248adc4458c8307650d7a5de97d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d97.bin
eeaabd6e9f58dc9d649165d45c3806535a83e5eab0b3596629b45f963ed33d21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D97 5072 bytes
font_01_sfnt_off00005eb9.bin
b2b27ef1b20f95d91d40c32e82fafeb4293e28f592f807cb43a79305b389f2ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EB9 10304 bytes
font_02_sfnt_off000081ac.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81AC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.