Malicious PDF — malware analysis report

Static analysis result for SHA-256 feb4cc857d35b7a0…

MALICIOUS

PDF

44.9 KB Created: 2020-08-03 10:05:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 86d994236695a6f25cd35db3ae0b7f74 SHA-1: b8beeba210665c1834b0d91b97bea41ba4116fb6 SHA-256: feb4cc857d35b7a0e58138d3fa6253971f0ca0777055eb25349ad78d659c429b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, with one prominent link directing to a known malicious redirector. The document body, though heavily obfuscated, contains text fragments related to 'Chrome version 44 download' and embedded URLs, suggesting a lure to trick users into clicking the malicious link. The presence of a 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic firing further supports this, indicating the link is intended to lead to harmful infrastructure.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=chrome+version+44+download
    • http://files.leoncentrum.sk/uploads/1/3/0/7/130776206/vofabose.pdf
    • http://files.paperlesstiger.net/uploads/1/3/2/6/132681728/wasagumebe.pdf
    • http://files.kravmagastavanger.com/uploads/1/3/2/6/132696274/debaxejuturiloditev.pdf
    • https://cdn.shopify.com/s/files/1/0430/3749/1357/files/bokan.pdf
    • https://cdn.shopify.com/s/files/1/0428/8544/7833/files/84621011356.pdf
    • https://cdn.shopify.com/s/files/1/0428/1666/7815/files/wikidaku.pdf
    • https://cdn.shopify.com/s/files/1/0433/4741/1096/files/atube_catcher_free.pdf
    • https://cdn.shopify.com/s/files/1/0431/6934/9794/files/66492469042.pdf
    • https://cdn.shopify.com/s/files/1/0435/2314/5896/files/delogiwuzaxudeli.pdf
    • https://cdn.shopify.com/s/files/1/0432/2299/1007/files/zabuziwivubinoberatanemat.pdf
    • https://cdn.shopify.com/s/files/1/0433/3341/9162/files/57467936198.pdf
    • https://cdn.shopify.com/s/files/1/0430/6308/3162/files/pigefeteromi.pdf
    • https://cdn.shopify.com/s/files/1/0437/9354/7424/files/jubij.pdf
    • https://cdn.shopify.com/s/files/1/0432/3196/9438/files/77078995086.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000050ba.bin
8d5d11c60d89a69a3cc95b5ac3b57e604c6110312e146499c5d4264a27d81de8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50BA 4992 bytes
font_01_sfnt_off00006231.bin
436c0177702cad473e9afd6c5591cb1544860ac449aae3e16700176901ab9306		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6231 5036 bytes
font_02_sfnt_off00007339.bin
a19d1bcad6000d591452bcbcf4de7af1ea5cd56498c5d9b7ace82e90d04ed2e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7339 10368 bytes
font_03_sfnt_off000096a9.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96A9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.