PDF malware analysis — malicious · 1c543379aab09c2b

MALICIOUS

PDF

49.8 KB Created: 2020-07-19 11:41:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 731239150207723273eda3efd8b614d3 SHA-1: 6803639ab9e7143e2ffb3305e08e86c38f6b4e7c SHA-256: 1c543379aab09c2b077aef3bd5b9cce24089878eaad47e5803988b19b6fa0d00

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm designed to mimic search engine results, with one prominent link leading to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'minerals and rocks worksheet answer key', suggesting a lure to trick users into clicking the malicious link. The primary malicious IOC is the redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=13.1+minerals+and+rocks+worksheet+answer+key
- http://files.drjessica.ca/uploads/1/3/1/4/131438293/winutoka_gowelerujoka.pdf
- http://files.aspectcareers.com/uploads/1/3/0/9/130969480/niguge.pdf
- http://files.manpatools.com/uploads/1/3/1/4/131406735/jijiwakarok.pdf
- http://files.aliciaallenphotography.com/uploads/1/3/2/6/132695493/9896495d62b1.pdf
- https://zekofanakem.f
- https://sesefami.files.wordpress.com/2020/07/nafib.pdf
- https://gowunexinelo.files.wordpress.com/2020/06/37245683771.pdf
- https://wuxewaxijij.files.wordpress.com/2020/06/wevevuwitu.pdf
- https://kigizog234742658.files.wordpress.com/2020/07/nekoke.pdf
- https://zekofanakem.files.wordpress.com/2020/06/sosavokiv.pdf
- https://vosameruki.files.wordpress.com/2020/07/jigir.pdf
- https://lokefisu.files.wordpress.com/2020/07/vesitinolukif.pdf
- https://lipozukot127920867.files.wordpress.com/2020/07/22026825785.pdf
- https://cdn.shopify.com/s/files/1/0434/7871/2472/files/44152125892.pdf
- https://cdn.shopify.com/s/files/1/0431/2553/8973/files/dudivesusazezewepotekiv.pdf
- https://cdn.shopify.com/s/files/1/0434/8493/8390/files/pabafumofovulim.pdf
- https://cdn.shopify.com/s/files/1/0433/3800/6686/files/48688341246.pdf
- https://cdn.shopify.com/s/files/1/0434/7111/0308/files/widuxipezupoxumogovigu.pdf
- https://cdn.shopify.com/s/files/1/0432/0778/6651/files/89843726396.pdf
- https://cdn.shopify.com/s/files/1/0432/5461/2123/files/jigesabufusenekujev.pdf
- https://cdn.shopify.com/s/files/1/0429/2214/8003/files/41128753497.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008456.bin` `5ec6eb54026bbe4b143cdc8396601efcc8e4d0cefe2cea054434b5a451ea3eb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8456	5376 bytes
`font_01_sfnt_off00009683.bin` `28c245efdf80031403bbf02dfaefe727f9bed7b58520fb8586593c0036c49fee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9683	10104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.