Malicious PDF — malware analysis report

Static analysis result for SHA-256 f23c61a98f7ceb9b…

MALICIOUS

PDF

56.3 KB Created: 2020-08-29 18:59:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02deeddd5dbc700843f73170ca5d6d75 SHA-1: 6e906dd38f6813cdf315f3809f25e1069233548a SHA-256: f23c61a98f7ceb9b5f5d093ca4e508fa9f5d2fcd7b6c3fea5d56ebb1f852f77e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with one critical heuristic firing indicating a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text referencing 'Farmville 2 country escape cheats no' and the malicious URL. This suggests a social engineering lure to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=farmville+2+country+escape+cheats+no
    • https://static.usrfiles.com/ugd/b8c837_616489f646b44c4f97f250f1b4d87860.pdf
    • https://static.usrfiles.com/ugd/8e1900_9b6930bbf5fd497cbafac0436383b700.pdf
    • https://static.usrfiles.com/ugd/eda9ba_e98ec4e9427842b191ab3555ef4b5fa9.pdf
    • https://static.usrfiles.com/ugd/b8c837_47b75c2ec8b442cbbc60aa9968ffe8a5.pdf
    • https://static.usrfiles.com/ugd/7ea8bb_2fb43a93e3c04aa1adc7c5fff8fa8856.pdf
    • https://cdn.shopify.com/s/files/1/0430/7465/0261/files/fafagapaxibe.pdf
    • https://cdn.shopify.com/s/files/1/0430/2739/8807/files/82251666470.pdf
    • https://cdn.shopify.com/s/files/1/0464/8904/3112/files/bose_soundlink_micro_waterproof.pdf
    • https://cdn.shopify.com/s/files/1/0427/4647/8759/files/lefuwagabofemekimi.pdf
    • https://static.usrfiles.com/ugd/b8c837_8f4a2c07e0b840fabca3136754149fbb.pdf
    • https://static.usrfiles.com/ugd/b8c837_c4a1883c5e7a42648fcf9bd8cf3c0d4a.pdf
    • https://static.usrfiles.com/ugd/b8c837_36333086043b4e07be6b7cde5fc459aa.pdf
    • https://static.usrfiles.com/ugd/b8c837_ceefa6617de046cab9af5e0a9b652215.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zemivok.pdf
    • https://cdn.shopify.com/s/files/1/0430/6095/3242/files/35108017259.pdf
    • https://cdn.shopify.com/s/files/1/0452/9052/0738/files/new_destination_b2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079a1.bin
f5abe119019d5191d8c7c3ef23d2cf547f0e4a8e61e2f8052103006b40352e31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79A1 5304 bytes
font_01_sfnt_off00008b86.bin
453660ccc98a2b0d228bc3f1a799e9df31103de0cb0df4bd626e53b6493093b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B86 7436 bytes
font_02_sfnt_off0000a11a.bin
b1004c00a211f3683c9eff38c8b78c10fcb43fe4b175a0e61bd328ac2f6d4c8a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA11A 10976 bytes
font_03_sfnt_off0000c5d1.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC5D1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.