PDF malware analysis — malicious · 2a8d9153569466ed

MALICIOUS

PDF

44.4 KB Created: 2020-08-17 06:31:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8e5066a71a3e1630b996ba32a8056db4 SHA-1: 0a744384e4968b0f6bc3943ef5b4f410a7e4ae00 SHA-256: 2a8d9153569466edf88f1ab200a171861dccf58021ef25764243a91efbd83b52

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on Shopify. One of the primary links, 'https://ttraff.cc/pify?keyword=banjara+lambadi+songs', is identified as a malicious redirector. This suggests the document's purpose is to redirect users to malicious content through a chain of links, likely for phishing or malware distribution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=banjara+lambadi+songs
- http://files.rebeccagaddie.com/uploads/1/3/0/9/130969494/lupewekivi_vurawodewebox.pdf
- http://files.lptannettdesigns.com/uploads/1/3/1/6/131606719/fexuvuxosaj.pdf
- http://files.mb-solutions.net/uploads/1/3/1/3/131383247/b0ab6fb0.pdf
- http://files.invictusaccounting.com/uploads/1/3/1/3/131398246/goxujezidinawivogu.pdf
- https://cdn.shopify.com/s/files/1/0451/0534/8761/files/bin_sachivalay_clerk_exam_paper_download.pdf
- https://cdn.shopify.com/s/files/1/0434/0134/7226/files/dadipovisixipubesofo.pdf
- https://cdn.shopify.com/s/files/1/0435/4415/0165/files/inverted_heart_book_folding_pattern.pdf
- https://cdn.shopify.com/s/files/1/0438/6045/9685/files/que_es_modelo_biopsicosocial.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/19441108854.pdf
- https://cdn.shopify.com/s/files/1/0434/4306/0901/files/how_to_use_multimeter_in_tamil.pdf
- https://cdn.shopify.com/s/files/1/0434/0570/5374/files/probability_and_measure_billingsley_solutions.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nozawilod.pdf
- https://cdn.shopify.com/s/files/1/0436/8806/7225/files/kovevomilapitos.pdf
- https://cdn.shopify.com/s/files/1/0438/2215/3890/files/gimifulusezonaxejuworulo.pdf
- https://cdn.shopify.com/s/files/1/0441/3086/1208/files/tom_hiddleston_imdb.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000054d7.bin` `1d44f7b877e86f1aa6e51aabdb42dae06513c0ca1aa696d3e7f11fb7f755993f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54D7	5408 bytes
`font_01_sfnt_off0000671d.bin` `75cf32b3e5865bc8a6f3bf6dfad816cc209d4c2ef658ec12ff8503f4165668d6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x671D	14740 bytes
`font_02_sfnt_off000094de.bin` `d4231f1a39914d2b892b997eed41ab927ee269c4aee68c42bf2cca25aed47dba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x94DE	4124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.