PDF malware analysis — malicious · 261843f197caae55

MALICIOUS

PDF

43.4 KB Created: 2020-09-06 23:48:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8d1ca73cdd1ac933b5e142a4db84e67f SHA-1: b0c0787952728f1cd15461359bad26781e27888c SHA-256: 261843f197caae55aa9925e780d693538e0d377cf6ff18d79cd509d856719fb9

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a download for 'Hungry Shark World' on Windows 7. The document body, though heavily obfuscated, contains the URL that the PDF_MALICIOUS_REDIRECTOR_LINK heuristic identified. The PDF also contains a link farm pointing to multiple other PDFs, suggesting an attempt to manipulate search engine results or distribute further malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=hungry+shark+world++windows+7
- https://static.usrfiles.com/ugd/77d535_20a2e8ae0d4e4312b1a9088b88becddc.pdf
- https://static.usrfiles.com/ugd/b8c837_40fac45572904770b6423b61e4f8c578.pdf
- https://static.usrfiles.com/ugd/37428b_1df03690533745adb13a05f6c2a5590e.pdf
- https://static.usrfiles.com/ugd/39cb9d_89ea6b3780a9482db5d0efc37fc020e2.pdf
- https://static.usrfiles.com/ugd/868b90_d8e1250d4c5847138fa2c1062c761b45.pdf
- https://static.usrfiles.com/ugd/067ecb_3658492571f14a1db69374a5ab3d5b1e.pdf
- https://static.usrfiles.com/ugd/7f614e_4b32ceaa00f942f8a2326118dc33db8a.pdf
- https://static.usrfiles.com/ugd/ce14f3_59cb0133390f49fda78de57643225151.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/49221060197.pdf
- https://cdn.shopify.com/s/files/1/0429/8155/6375/files/xiwezigejipomebil.pdf
- https://cdn.shopify.com/s/files/1/0427/6636/8935/files/80255372680.pdf
- https://cdn.shopify.com/s/files/1/0431/2567/0042/files/dividing_whole_number_by_fractions_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0437/4704/9621/files/52555586779.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dojedeteremedadedarovir.pdf
- https://cdn.shopify.com/s/files/1/0435/0548/3942/files/20444159171.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000069e3.bin` `ae1904cb584b2bf86678eb64139313222d69dfaa2f02c8ab2d572204b3828e89`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69E3	5384 bytes
`font_01_sfnt_off00007c4a.bin` `dff7ea93e3fe61f16c2b1c4918892675c47093765bd4b41d37c9bd2eb67703d1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C4A	11664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.