Malicious PDF — malware analysis report

Static analysis result for SHA-256 edba1472ecef7011…

MALICIOUS

PDF

42.6 KB Created: 2020-08-30 17:43:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d378aaa21838c816e89aa607cc01cfd SHA-1: 1dc06f084b9e19f9ec0b60008579b7098c12a569 SHA-256: edba1472ecef701103bb5bffe332d5976a9f6bf1a65ecd142c6f07b299bbf383
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure for 'Astérix et obélix streaming hd' and embeds multiple links. One of these links, 'https://ttraff.ru/wix?keyword=ast%2525C3%2525A9rix+et+ob%2525C3%2525A9lix+streaming+hd', is flagged as a known malicious redirector. The document's structure and embedded links suggest a phishing or redirection attack aimed at users seeking entertainment content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wix?keyword=ast%2525C3%2525A9rix+et+ob%2525C3%2525A9lix+streaming+hd
    • https://static.usrfiles.com/ugd/b88e3d_db1eb720e76e403fa6ba808e1fe6ce73.pdf
    • https://static.usrfiles.com/ugd/b8c837_c0edaad8b0b745749f717728206c2b2d.pdf
    • https://static.usrfiles.com/ugd/b8c837_ce009ef657864d7f8b0a84db86214aba.pdf
    • https://cdn.shopify.com/s/files/1/0429/2414/6855/files/top_platform_games_pc.pdf
    • https://cdn.shopify.com/s/files/1/0429/9646/5823/files/zamawoxopip.pdf
    • https://cdn.shopify.com/s/files/1/0437/8922/2037/files/lozezodapur.pdf
    • https://cdn.shopify.com/s/files/1/0430/4856/6933/files/jurnal_amebiasis.pdf
    • https://cdn.shopify.com/s/files/1/0434/0649/1797/files/the_bare_necessities_piano_sheet_music.pdf
    • https://cdn.shopify.com/s/files/1/0433/4845/9675/files/rabiz.pdf
    • https://cdn.shopify.com/s/files/1/0436/3393/4496/files/prayer_timetable_2020.pdf
    • https://cdn.shopify.com/s/files/1/0437/3735/0293/files/nufasumifidibumizatux.pdf
    • https://cdn.shopify.com/s/files/1/0432/3809/7051/files/36771437420.pdf
    • https://cdn.shopify.com/s/files/1/0431/8425/9231/files/sufewoziwodudixa.pdf
    • https://cdn.shopify.com/s/files/1/0431/6866/1670/files/online_calendar_template_march_2019.pdf
    • https://cdn.shopify.com/s/files/1/0430/9372/1255/files/historietas_cortas_para_imprimir_y_c.pdf
    • https://cdn.shopify.com/s/files/1/0434/8333/2772/files/examples_of_assumptions_in_research.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064e0.bin
b019d94e057d9c2ba2a19f127987eab4ae3018e727b78fd8253aa9acaaeb90b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64E0 5576 bytes
font_01_sfnt_off00007759.bin
dee04dfca6cd9e5371a13dcdebadc9088d5724666cbfd2f40e93b16d331f515b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7759 10824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.