PDF malware analysis — malicious · 250b648b14570a01

MALICIOUS

PDF

39.8 KB Created: 2020-08-17 15:11:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 01c0a1f7bf842f20c128533113855126 SHA-1: 37d14b13d4dd404c244ebb9671f48841c563edfb SHA-256: 250b648b14570a01db59b8ed219e4e9075f38054559d8043cf53d79f975f046d

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, many pointing to Shopify domains hosting other PDFs, but one critical link directs to a known malicious redirector. The document body, though heavily obfuscated, contains the same URL as the malicious redirector, suggesting an attempt to disguise malicious content as a movie download lure. The presence of a malicious redirector link indicates the document's primary purpose is to lead the user to a harmful destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=baghban+full+movie+hd+1080p+free
- http://files.gothamed.org/uploads/1/3/0/8/130873876/sijujelatododa.pdf
- http://files.carolinahandysmith.com/uploads/1/3/1/8/131871786/1267875.pdf
- https://cdn.shopify.com/s/files/1/0435/9972/4703/files/67306319928.pdf
- https://cdn.shopify.com/s/files/1/0430/2897/1681/files/ziwunatawebev.pdf
- https://cdn.shopify.com/s/files/1/0431/0673/0138/files/wupifepesovonedotezaj.pdf
- https://cdn.shopify.com/s/files/1/0435/8481/5259/files/vigurozumagudal.pdf
- https://cdn.shopify.com/s/files/1/0438/8297/1291/files/que_es_el_cariotipo_humano.pdf
- https://cdn.shopify.com/s/files/1/0437/8856/6677/files/immunoglobulins_types.pdf
- https://cdn.shopify.com/s/files/1/0438/2110/5309/files/foxabovodipojaxus.pdf
- https://cdn.shopify.com/s/files/1/0433/7860/6229/files/57092112088.pdf
- https://cdn.shopify.com/s/files/1/0429/0589/5075/files/17665673098.pdf
- https://cdn.shopify.com/s/files/1/0434/9270/4408/files/gejisewixisexip.pdf
- https://cdn.shopify.com/s/files/1/0433/3935/0181/files/causation_philosophy.pdf
- https://cdn.shopify.com/s/files/1/0445/4842/3844/files/bhakti_and_sufi_movement_upsc.pdf
- https://cdn.shopify.com/s/files/1/0429/2627/6775/files/83635394693.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000474a.bin` `f13e0a6a8839ba915d51c9476cbb4225cc215b156f9f1d9e366ed756eeaed401`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x474A	5916 bytes
`font_01_sfnt_off00005b42.bin` `7aa04968aa418fe309cf3c6a65f1599848766e605c5841d62b87a23ab4f7a947`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B42	9860 bytes
`font_02_sfnt_off00007d20.bin` `6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D20	16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.