Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbbb7df6eb91979b…

MALICIOUS

PDF

44.8 KB Created: 2020-09-17 05:53:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 805188ffdb4cf6cfc57c5c04fb8534e9 SHA-1: 6bc42ed4b6c4fb2a8b6641c79c24b5bd894f700f SHA-256: fbbb7df6eb91979b52118ff6dfbf17dd6a725c9243ad83b29188c254106da6ff
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a link to a redirector, which in turn leads to a page advertising a "hay day hack apk download new version". This suggests a social engineering lure to trick users into downloading potentially unwanted or malicious software. The PDF also contains a large number of external links, characteristic of SEO spam or link farms, further indicating a malicious intent to drive traffic to various sites.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=hay+day+hack+apk+download+new+version
    • http://tewov.aatp-mysterygames.com/uploads/1/3/0/8/130814347/27e981b01ec15.pdf
    • http://risutima.jjsmithelectrical.com.au/uploads/1/3/1/3/131381924/lobemetit.pdf
    • http://files.louiesaviary.com/uploads/1/3/1/4/131454696/d63ca2957.pdf
    • http://files.nextllcenter.com/uploads/1/3/1/4/131406149/pesuvusetap-sopop-jukekozipo-wexis.pdf
    • https://8db06e3f-aa3e-4d27-a66a-57eb4bf77d86.filesusr.com/ugd/7a359d_37266de343fc4950a0a97b97560261ba.pdf?index=true
    • https://bc311e5a-19aa-45ad-a3ea-a49f77892c9b.filesusr.com/ugd/a6e5e9_bdcdea000efc4525bd19483a403f5c5e.pdf?index=true
    • https://f729eee1-a222-4db0-8e66-2ca49ef74a8f.filesusr.com/ugd/229b11_0001531815b24177b4efd6be749fdb8f.pdf?index=true
    • https://dad46d8d-4d40-4f05-b85f-d7c378d5e603.filesusr.com/ugd/b58d21_8529d6456ef7461dbe8f607c486f708c.pdf?index=true
    • https://5fb1f88b-420e-4a42-bc5b-479a7c695cef.filesusr.com/ugd/a467d2_7f050f709369423898d82ea85cae8e9d.pdf?index=true
    • https://cdn.shopify.com/s/files/1/0439/2907/5880/files/melodic_tune_crossword_answer.pdf
    • https://cdn.shopify.com/s/files/1/0435/8638/8123/files/yardi_manual.pdf
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/benivat.pdf
    • https://cdn.shopify.com/s/files/1/0437/2607/8106/files/undergraduate_cell_biology_laboratory_manual.pdf
    • https://d0761018-a0d8-40e5-b036-15eadda82baf.filesusr.com/ugd/3eed2b_4479e39e5cd44e41a571db85596d2e9b.pdf?index=true
    • https://e6febc7b-d815-4c94-b909-50677d098a13.filesusr.com/ugd/43d598_5977d96fff0e4a2990031fe82fd3600f.pdf?index=true
    • https://a6f637e6-e00f-428a-8caf-b2e01de20445.filesusr.com/ugd/1be480_c39a41c3556541148692d18f9b3c2e02.pdf?index=true
    • https://0e1b666f-77c9-4484-bf59-e0ce7f703b93.filesusr.com/ugd/1b6cec_2481e4f2512d4239a6e839d5250cbeb1.pdf?index=true
    • https://9f58426d-6f15-47dc-88a9-bd571a69cb81.filesusr.com/ugd/3bcfef_f88ba51db8b64fedbe2d08634765ef24.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ebc.bin
cc479fb663a50732b4a785e36ccc3c6353598ed130bcbbf8f93ce64f913e14a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EBC 5440 bytes
font_01_sfnt_off00008154.bin
30721f674fe5fa7dc628917419fd69da20495bd82f9b7cc4efb3f78186621585		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8154 10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.