Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2c822fc5e254afa…

MALICIOUS

PDF

64.4 KB Created: 2020-08-25 21:18:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8cbb0827d9cf7c23cc6273a6f3562de SHA-1: adb0fb149f70c60dd41db268412dd754647e6034 SHA-256: f2c822fc5e254afaa52dc72699b563197b342a163373684fefbf06988fe2ea38
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a lure document disguised as a 'Wizard equipment guide bdo' which embeds numerous links. One of these links, 'https://ttraff.com/pify?keyword=wizard+equipment+guide+bdo', redirects to known malicious infrastructure. The document also exhibits characteristics of an MFA or one-time-code harvesting lure, suggesting an attempt to steal user credentials or session tokens. The presence of a link farm further indicates a phishing or credential harvesting campaign.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=wizard+equipment+guide+bdo
    • http://files.tylerlakect.com/uploads/1/3/2/7/132740639/14112ce59842dc.pdf
    • http://lidadez.fjcampbell.net/uploads/1/3/1/0/131069934/3912040.pdf
    • http://files.artistscollections.org/uploads/1/3/1/4/131452878/lefuvisel_dijobo.pdf
    • https://cdn.shopify.com/s/files/1/0438/0744/1053/files/lexomidogimisu.pdf
    • https://cdn.shopify.com/s/files/1/0437/8991/0167/files/60518039117.pdf
    • https://cdn.shopify.com/s/files/1/0435/7334/6465/files/75885632985.pdf
    • https://cdn.shopify.com/s/files/1/0433/9597/3271/files/breast_cancer_fact_sheet.pdf
    • https://cdn.shopify.com/s/files/1/0435/8907/5099/files/53580452643.pdf
    • https://cdn.shopify.com/s/files/1/0451/2923/6645/files/asia_political_map_outline.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nuruge.pdf
    • https://cdn.shopify.com/s/files/1/0429/9328/7331/files/silazuvefefuzoxelewore.pdf
    • https://cdn.shopify.com/s/files/1/0432/3983/3763/files/guxuzot.pdf
    • https://cdn.shopify.com/s/files/1/0440/2541/3782/files/swot_analysis_journal.pdf
    • https://cdn.shopify.com/s/files/1/0427/5562/1031/files/wimawugiji.pdf
    • https://cdn.shopify.com/s/files/1/0438/0380/3808/files/white_plume_mountain_3._5_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00009fe9.bin
36b44bc714abf3d8a66b67e8d071c189ddc0b71e3a119b3a2e30bb3798e602ed		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9FE9 11136 bytes
font_00_sfnt_off00008dae.bin
52ced52c79693c8eec8ad0f4cad2443fa6901316a8e4789ae77725166f62677e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DAE 5396 bytes
font_02_sfnt_off0000bf3d.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBF3D 1800 bytes
font_03_sfnt_off0000c7ca.bin
f2a63585174dad45276eba9855b2d9f5ceaea79f9de8d99d887e6fcd735d8b55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7CA 13004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.