PDF malware analysis — malicious · 231a08b727bd12ee

MALICIOUS

PDF

48.2 KB Created: 2020-08-23 08:53:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 902449e053e987a90c9f4a7e2c4c7b4b SHA-1: 3c4f1b7268065ee5b3af65371153f620c0b48a86 SHA-256: 231a08b727bd12ee48e3caec04bd11293a4de2d2dde931e5bbb0f97b8382008f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.ru/pify?keyword=facebook+advertentie+formaat+foto'. The document body, though heavily obfuscated, contains this URL and appears to be a lure related to Facebook advertising formats. The PDF also contains a large number of embedded links, many pointing to Shopify domains, suggesting a link farm or content distribution strategy. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=facebook+advertentie+formaat+foto
- http://files.psaba.org/uploads/1/3/0/8/130874368/fuzorofigiv_fuzepoxenuxefe_moludizarogube.pdf
- http://files.cakeballsforacause.com/uploads/1/3/1/6/131606630/e8605c.pdf
- http://files.drmikecounseling.com/uploads/1/3/1/6/131637714/voxaduz_nimatusulaw.pdf
- http://files.tinwagonboutique.com/uploads/1/3/0/7/130739163/badoxanir.pdf
- http://files.amdacious.com/uploads/1/3/0/8/130874455/8589287.pdf
- https://cdn.shopify.com/s/files/1/0432/7017/6928/files/sheet_music_chopin_prelude_in_e_minor.pdf
- https://cdn.shopify.com/s/files/1/0434/7677/9174/files/51197736839.pdf
- https://cdn.shopify.com/s/files/1/0436/2849/5001/files/speer_reloading_data.pdf
- https://cdn.shopify.com/s/files/1/0436/9845/4682/files/govivun.pdf
- https://cdn.shopify.com/s/files/1/0438/6773/4171/files/crema_de_vainilla_artemisa_tellez.pdf
- https://cdn.shopify.com/s/files/1/0433/1667/4713/files/cantos_de_adoracion_al_santisimo.pdf
- https://cdn.shopify.com/s/files/1/0440/4156/8421/files/kurekobogutuvi.pdf
- https://cdn.shopify.com/s/files/1/0432/5982/2244/files/40074508587.pdf
- https://cdn.shopify.com/s/files/1/0428/7902/5318/files/60606024723.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006078.bin` `7df658cadbfec926a64220178009cacae423265005932130707c8f77a79c9773`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6078	5176 bytes
`font_01_sfnt_off000071fc.bin` `51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71FC	1800 bytes
`font_02_sfnt_off00007a8a.bin` `0773d6efff9a2a0e278bfef24c6327fe04e24ae3a4c0c5cffde401fcfdd8fa3d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A8A	10288 bytes
`font_03_sfnt_off00009ded.bin` `bf8f9ece8d9d74ce2d7a98a07ee1bb8f4056faf702b3b1702118181e85f1b939`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9DED	16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.