Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef7c1bf46b7806e1…

MALICIOUS

PDF

35.9 KB Created: 2020-09-01 15:06:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65e1248f9c94f7a2537831441a30dc32 SHA-1: c8bde38a0cbc4777c087a0b6364c15ef8ba16e93 SHA-256: ef7c1bf46b7806e1b83cf28697707bf3e065758a97b513b9b0b7811aec272aa5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm and a malicious redirector URL, indicating an attempt to lead the user to a harmful site. The document body, though heavily obfuscated, contains text related to 'Bansal classes study material physics pdf' and the malicious URL, suggesting a lure for educational content. The primary malicious IOC is the redirector URL.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=bansal+classes+study+material+physics+pdf
    • https://static.usrfiles.com/ugd/b8c837_23d4e0d7390145788bea8d2e38bd1cc9.pdf
    • https://static.usrfiles.com/ugd/e3c460_6ad2fbff2a52469ca254fcb8c466e202.pdf
    • https://static.usrfiles.com/ugd/b8c837_348a381b90e04564b8edfbc84f6041ee.pdf
    • https://cdn.shopify.com/s/files/1/0434/3631/0693/files/27315469017.pdf
    • https://cdn.shopify.com/s/files/1/0461/5376/0931/files/arcane_legends_new_version.pdf
    • https://cdn.shopify.com/s/files/1/0458/2254/1987/files/high_coliform_count_in_well_water.pdf
    • https://cdn.shopify.com/s/files/1/0429/3551/7337/files/18787664328.pdf
    • https://static.usrfiles.com/ugd/e2b09b_734d8604d1634f30b6046e008ff589d6.pdf
    • https://static.usrfiles.com/ugd/de65f7_5b36ea2da5b04f4cb484e3eb0685b5ca.pdf
    • https://static.usrfiles.com/ugd/cc14e4_e1ed7b4860c34ab8aa40c16e96cb8e7d.pdf
    • https://static.usrfiles.com/ugd/c20ea7_c8b2d71ea61643009883c37337bacac8.pdf
    • https://static.usrfiles.com/ugd/b8c837_17b520230dd540249265e3f1790e9bfc.pdf
    • https://static.usrfiles.com/ugd/ddb60a_73e08729345c4dc5af9e10eae068b8dd.pdf
    • https://static.usrfiles.com/ugd/0adedf_a828b02898be400f8a281dfc94cfbc0c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004cdc.bin
ffe3935ba89f4497393b569f88433cd72d0dfa36dab605d87f0255e2a848fad9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CDC 5544 bytes
font_01_sfnt_off00005f95.bin
b3800bc5cab36fe339fc184bffdf4c4d85269320d0cdd8a949c44e538661c4c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F95 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.