PDF malware analysis — malicious · 26613688eec1b166

MALICIOUS

PDF

46.8 KB Created: 2020-08-10 21:16:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 800fe3576b19ba5f8302e19fdd159cec SHA-1: 464f43e807a756f4e03cb551b21b1557cc5c634e SHA-256: 26613688eec1b166a42926425a768f31478865a8824dd1da584f523ba4eaf858

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous links, including one pointing to a known malicious redirector at 'https://ttraff.cc/pify?keyword=livre+pour+apprendre+le+chinois+pdf'. This suggests a phishing or scam attempt where the user is tricked into downloading a file or visiting a malicious site. The document body, though heavily obfuscated, also contains this URL, reinforcing the malicious intent. No scripts were extracted, limiting the analysis of further payload delivery or execution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=livre+pour+apprendre+le+chinois+pdf
- http://tipabis.cultural-fibers.com/uploads/1/3/1/0/131070450/5187184.pdf
- http://files.shandeezcollectiv.com/uploads/1/3/0/9/130968984/kewugifo-pulodabimog.pdf
- http://tosiji.mackaychocolatebouquets.com.au/uploads/1/3/1/3/131380213/8902773.pdf
- http://files.vincetease.com/uploads/1/3/0/7/130775017/fuferubaka.pdf
- https://cdn.shopify.com/s/files/1/0434/0868/7269/files/80299506016.pdf
- https://cdn.shopify.com/s/files/1/0431/9812/0094/files/regional_manager_interview_questions_and_answers.pdf
- https://cdn.shopify.com/s/files/1/0438/1461/7250/files/72926513959.pdf
- https://cdn.shopify.com/s/files/1/0428/1358/7623/files/narepelabawijiwosawowug.pdf
- https://cdn.shopify.com/s/files/1/0430/7540/3936/files/puzokowuje.pdf
- https://cdn.shopify.com/s/files/1/0435/0155/1771/files/mupasarekovifabe.pdf
- https://cdn.shopify.com/s/files/1/0429/6481/1927/files/fukakata.pdf
- https://cdn.shopify.com/s/files/1/0453/2230/5691/files/antibiotics_ppt.pdf
- https://cdn.shopify.com/s/files/1/0431/3799/0818/files/79529570483.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dojedeteremedadedarovir.pdf
- https://cdn.shopify.com/s/files/1/0436/5670/8254/files/jamedigilujigenafix.pdf
- https://cdn.shopify.com/s/files/1/0434/6747/3046/files/pathfinder_books.pdf
- https://cdn.shopify.com/s/files/1/0431/7695/1974/files/86995341239.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000729a.bin` `3c065bdefc6d2d4fd7c65c188f06d33d4b772af2e0009aac7ef3242eed5816fd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x729A	5244 bytes
`font_01_sfnt_off0000846b.bin` `db9ff99660dc1094604297f31630a522ea78387bf9478df4ac3f914aec9991af`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x846B	12880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.