Malicious PDF — malware analysis report

Static analysis result for SHA-256 f24fc91d145652a5…

MALICIOUS

PDF

43.2 KB Created: 2020-07-27 21:08:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 380caae687577f3bd5df749daf71f354 SHA-1: 8a2edad5314995645912c9ef408f35947d85d592 SHA-256: f24fc91d145652a5e378555dc52eb1c83225f9d14f19f49865c31ea9c3b6a539
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic indicating it's a malicious redirector link, pointing to a URL that is part of a known malicious infrastructure. Additionally, it exhibits characteristics of an advance-fee scam lure, suggesting the document is designed to trick the user into believing they are accessing legitimate content, such as a discussion guide, while actually directing them to a malicious site. The file also contains a large number of embedded URLs, many hosted on Shopify, which is indicative of a link farm used for SEO manipulation or to obscure the true destination.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=respectable+sins+discussion+guide+pdf
    • http://files.mintbeautyboutique.com/uploads/1/3/1/4/131438228/2594854.pdf
    • http://files.theballstrikers.com/uploads/1/3/1/8/131856771/dogenavusegolabo.pdf
    • http://files.simonshotdogs.com/uploads/1/3/1/4/131409761/suroverezeluva.pdf
    • http://files.zudane.com/uploads/1/3/1/4/131455283/3693178.pdf
    • http://files.sensefitnesscoaching.com/uploads/1/3/0/7/130776594/faef11.pdf
    • http://files.zudane.com/uploads/1/3/1/4/13145
    • https://cdn.shopify.com/s/files/1/0428/4982/9023/files/53368072227.pdf
    • https://cdn.shopify.com/s/files/1/0439/0407/3883/files/wunusadusirepaxawur.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/sesolofulazige.pdf
    • https://cdn.shopify.com/s/files/1/0438/4597/6221/files/baranugurojigunipufaja.pdf
    • https://cdn.shopify.com/s/files/1/0429/8748/7395/files/72362259006.pdf
    • https://cdn.shopify.com/s/files/1/0436/6696/4630/files/norapopofonetaduvepowajom.pdf
    • https://cdn.shopify.com/s/files/1/0430/9064/1047/files/movogoxudu.pdf
    • https://cdn.shopify.com/s/files/1/0432/8869/0841/files/80168561638.pdf
    • https://cdn.shopify.com/s/files/1/0433/5144/1563/files/lulepifawamapifekukobe.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/76685421079.pdf
    • https://cdn.shopify.com/s/files/1/0430/9814/4932/files/wezonasa.pdf
    • https://cdn.shopify.com/s/files/1/0432/3170/7294/files/44910490972.pdf
    • https://cdn.shopify.com/s/files/1/0432/2911/8627/files/vogaxakotor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000696e.bin
50749625ec28939a903bb40d22da03ce126071e13b4218d322e175885afb7552		 pdf-font-stream PDF embedded font (sfnt) at offset 0x696E 5256 bytes
font_01_sfnt_off00007b63.bin
1aed8b26a19b36bc213ce0fed02199503dd850c87e0c8f46c6bcdd4afcefc079		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B63 10676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.