PDF malware analysis — malicious · 2491e847dfd8b97c

MALICIOUS

PDF

43.5 KB Created: 2020-07-19 18:44:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 002c12e30b3b6d57407b47e2d68697d0 SHA-1: 33ef71de5745368e1e45c8238a54f9265e9b82fc SHA-256: 2491e847dfd8b97c0d2e0c0589e2a10b5c8b398591e59dd5d5f6fa602c0071e6

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing indicating it points to known malicious redirector infrastructure. The document body, though heavily obfuscated, suggests a 'manual' lure. The presence of multiple SEO-style links further supports the attack pattern of using link farms to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wb?keyword=manual%20for%20bissell%20proheat%20pet
- http://files.cavalierbattalion.com/uploads/1/3/1/3/131379477/rusugijapufaju.pdf
- http://files.nteu173.org/uploads/1/3/1/6/131606640/1830166.pdf
- http://files.mtrainiermonsterz.com/uploads/1/3/0/9/130969522/filesonekadijit_jenopojoz_sazujoso_miforabimawivat.pdf
- http://files.midwestdressage.org/uploads/1/3/1/4/131453867/dilibarofaxi_bazemunoruw.pdf
- http://files.everlastfilm.com/uploads/1/3/0/8/130814652/lirivovemulub.pdf
- http://files.jhwolfanger.com/uploads/1/3/1/1/131164506/gogiruki.pdf
- http://files.bradfordscholarship.org/uploads/1/3/2/6/132681456/5622002.pdf
- https://wakogokanexu.file
- https://wakogokanexu.files.wordpress.com/2020/07/53273631830.pdf
- https://digogaba.files.wordpress.com/2020/06/94950999511.pdf
- https://rilivot.files.wordpress.com/2020/06/5976034845.pdf
- https://cdn.shopify.com/s/files/1/0432/8348/0736/files/tajigodoxerolote.pdf
- https://cdn.shopify.com/s/files/1/0432/3137/9618/files/24981554359.pdf
- https://cdn.shopify.com/s/files/1/0430/8677/4436/files/90810796500.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/sosivizugepu.pdf
- https://cdn.shopify.com/s/files/1/0429/5317/9289/files/18141303402.pdf
- https://cdn.shopify.com/s/files/1/0431/0096/2977/files/79606678554.pdf
- https://cdn.shopify.com/s/files/1/0428/5300/7516/files/tovapasovezazowu.pdf
- https://cdn.shopify.com/s/files/1/0428/8148/2919/files/59911165360.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006e08.bin` `038813ff57c2cc356268508999fd7768695b712a3d85add602d40cf23cf1b71c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E08	5016 bytes
`font_01_sfnt_off00007f0b.bin` `e29e3092d621b45efd061a1f3fdfa053756d9c80add517e089718cfde678ea13`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F0B	9824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.