PDF malware analysis — malicious · 1ad4c5c48a51886a

MALICIOUS

PDF

37.4 KB Created: 2020-08-15 04:55:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 71e5cc7bbb908433c8b6eb780011d0f7 SHA-1: 02ca438c51522edc4e6c1f4df0d7f18a9b107e4b SHA-256: 1ad4c5c48a51886acccb5efdec79e95c2c64dc625ca6390b118e4c084d74a7f7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link that redirects to a malicious URL, disguised as a download for 'chapter 11 lord of the flies pdf'. The PDF also contains a large number of embedded links, many of which point to Shopify domains, likely as part of a link farm to improve search engine ranking for malicious content. The primary malicious URL identified is ttraff.com, which is known for redirecting to malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=chapter+11+lord+of+the+flies+pdf In PDF document text
- http://files.baffen35.com/uploads/1/3/0/8/130874520/9211386.pdfIn PDF document text
- http://towobu.pedalthepennines.co.uk/uploads/1/3/1/3/131398091/konipo_mivorodigipiw.pdfIn PDF document text
- http://files.lighterthanairky.com/uploads/1/3/1/3/131398140/46a69686.pdfIn PDF document text
- http://files.gatorrughookinggroup.com/uploads/1/3/0/9/130969003/katabowoxukewe.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0439/7318/1598/files/jobapojo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/3049/4878/files/grade_1_science_worksheets_materials.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/0378/1015/files/fijaluzafuvesupufig.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/pizejop.pdfIn PDF document text
- http://sorupuro.jes-lee-shop.square.site/uploads/1/3/1/4/131438079/2893234.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/1261/8402/files/barish_ka_pani_song_mp4.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/5131/7408/files/97731388188.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/4777/8469/files/fadetufuku.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/6211/7030/files/22382174799.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/7133/2767/files/fonizijejosemoxovid.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000572e.bin` `8812330a49130e133b485d2a2a80cbe1527a00b2d6d4b499b66602d1740419f5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x572E	5088 bytes
`font_01_sfnt_off00006875.bin` `da8b63869c7899d8db8abb23143ca11c03ff569afe12e8654aefa42481e575ab`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6875	9548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.