Malicious PDF — malware analysis report

Static analysis result for SHA-256 f648f92d5312e182…

MALICIOUS

PDF

38.5 KB Created: 2020-07-08 15:20:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d2a5e28ff76d5fa1f21df64d091d976 SHA-1: 8439d0e3cf44a54b40b013c13fd626c5cea99229 SHA-256: f648f92d5312e1827ff233fea4a684c76a7f568dad5fd50b135d29039888963f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded links, many of which point to external PDF files hosted on various domains. One prominent link redirects to 'https://ttraff.ru/wb?keyword=alphabet%20activities%20worksheets%20pdf', which is identified as a malicious redirector. The document's content, 'Alphabet activities worksheets pdf', is a lure to encourage users to click these links. The presence of numerous external PDF links suggests a link farm or SEO poisoning tactic to distribute malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/wb?keyword=alphabet%20activities%20worksheets%20pdf
    • http://files.danavaproductions.com/uploads/1/3/1/3/131383305/7423760.pdf
    • http://files.kidsquidstudios.com/uploads/1/3/1/4/131452794/jewutabune_kowido_xamafuvevasitaj.pdf
    • http://files.cdebtherapy.com/uploads/1/3/1/6/131637325/841d823a2cc03bb.pdf
    • http://files.visualronin.com/uploads/1/3/1/4/131438819/8598117.pdf
    • http://files.cobilconnect.com/uploads/1/3/0/9/130969853/6ea8d66a.pdf
    • http://files.condzellasfarm.com/uploads/1/3/0/9/130969555/97c8dd5b0b0479.pdf
    • http://files.alifeworthliving2.org/uploads/1/3/0/8/130874318/lenalaw-fowez-legojumafixixin-tunotababivofen.pdf
    • http://files.ncam.ac.nz/uploads/1/3/0/7/130776788/a94fe6a1c2f25a.pdf
    • http://files.earthtorique.com/uploads/1/3/1/4/131454850/nulijujo-zilepi-sepolajep-peburasi.pdf
    • http://files.sydneynorthshorepolishsaturdayschool.org/uploads/1/3/2/7/132710575/gewuxoma_tezekuzevera.pdf
    • https://xarufuze.files.wordpress.com/2020/06/raxebebudarudoradimalub.pdf
    • https://remumalu.files.wordpress.com/2020/06/52061225553.pdf
    • https://xexufadotafu.files.wordpress.com/2020/06/dapidopoxiroxasomi.pdf
    • https://kadawajoxezo.files.wordpress.com/2020/06/fapojitesigamopomexemexi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058a7.bin
1affbd4742104e2a847bb29680894a6136a23483c3e38229960bf8937ed34236		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58A7 5272 bytes
font_01_sfnt_off00006aac.bin
dc3196fd94c6f14487a3a772e158434329ae6aa909445c967579ba059da87816		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6AAC 10128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.