Malicious PDF — malware analysis report

Static analysis result for SHA-256 f417d792ec9143b6…

MALICIOUS

PDF

51.3 KB Created: 2020-09-16 19:00:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f19620f8ab829a9ea6262f5159f0642 SHA-1: d5c03bc9f342ce5d1e7cddd330f151727283ab42 SHA-256: f417d792ec9143b66be7280867b088020824f57ed8a9933f35eefd7bda9f31e0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to redirectors or link farms, indicating a malicious intent to drive traffic to potentially harmful sites. The primary lure appears to be related to 'minecraft unblocked games 76', as seen in the document body and one of the malicious URLs. The heuristic firings confirm the presence of malicious redirector links and a link farm, strongly suggesting this PDF is designed for malicious redirection.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=minecraft+unblocked+games+76
    • http://files.primerentals.us/uploads/1/3/2/6/132696506/rexobavebiwono_giwove.pdf
    • http://waxej.msdurrett.com/uploads/1/3/1/6/131637457/f3598ccc.pdf
    • http://files.mehlmansmunchkins.com/uploads/1/3/0/7/130740212/f41c8.pdf
    • http://vulot.lukaspoischbeg.com/uploads/1/3/0/7/130739540/dea6b111.pdf
    • http://files.jenkinsphoto.com/uploads/1/3/0/8/130874554/zikol-mumoranawiv-zabot.pdf
    • https://cdn.shopify.com/s/files/1/0435/5417/7185/files/anbe_sivam_movie_in_tamilyogi.pdf
    • https://cdn.shopify.com/s/files/1/0430/2520/3354/files/hannah_crafts_the_bondwoman_s_narrative.pdf
    • https://cdn.shopify.com/s/files/1/0430/8729/8714/files/kukogexafali.pdf
    • https://cdn.shopify.com/s/files/1/0432/2571/0750/files/90058739173.pdf
    • https://cdn.shopify.com/s/files/1/0437/5845/2897/files/10957328686.pdf
    • https://76ed91da-bf49-4857-8fb2-81681ff65da8.filesusr.com/ugd/8e66a5_47e6eb5117d64c3a8bdcff3e2c4c1e0d.pdf?index=true
    • https://7f9146c5-6751-40cb-a739-d7244c0d6dc9.filesusr.com/ugd/aec2ea_d54e6d51190c455a8516d36459952d8b.pdf?index=true
    • https://12839eed-907b-4bf1-88ba-dd8ea023d9f5.filesusr.com/ugd/93c935_685c07658f634c5b831855d88c3f45d6.pdf?index=true
    • https://1398cfc9-232d-4419-be97-da0fa905dff8.filesusr.com/ugd/5bb01c_abe4b2f2a18b4415b27735d9b50d8d81.pdf?index=true
    • https://9612e5ea-76d7-4a13-9ff5-f5b98a397a64.filesusr.com/ugd/696117_b1fa0a6e4c1744c3be0464e027f23a56.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a58.bin
7d26681497f57a06c783fcbbbed10ba73c98bc9baf7c2807dbe696a253551667
pdf-font-stream PDF embedded font (sfnt) at offset 0x7A58 5668 bytes
font_01_sfnt_off00008d94.bin
c089973c5cf68024d285eeae8dba9aabfa72d7d25d4a4838cafeb96298649f06
pdf-font-stream PDF embedded font (sfnt) at offset 0x8D94 10696 bytes
font_02_sfnt_off0000b21f.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3
pdf-font-stream PDF embedded font (sfnt) at offset 0xB21F 4324 bytes