PDF malware analysis — malicious · 34b36fe4e56800da

MALICIOUS

PDF

67.7 KB Created: 2020-07-30 20:02:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4f842da2b2d8b47c9fa4e12874b25c12 SHA-1: 266928051f81895a60f1298ca3264b5c94c96ed4 SHA-256: 34b36fe4e56800da2549db04491cc57663d02ca89db47fb4a54a6bbdf1c2ed3c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous links designed to appear as legitimate documents, but the primary link redirects to a known malicious domain. This indicates a phishing or redirection attack. The PDF also hosts a large number of external links, suggesting a link farm for SEO manipulation or to obscure the malicious redirector. No scripts were extracted, but the heuristic firings strongly suggest a malicious redirection chain.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=shear+force+and+bending+moment+calculation+pdf
- http://files.laramaupin.site/uploads/1/3/2/7/132710797/27ed3e65446399.pdf
- http://files.alexheadadventures.com/uploads/1/3/0/7/130740625/776290ead9.pdf
- http://files.stmarysandstjosephs.com/uploads/1/3/0/8/130813645/jugavazanite.pdf
- http://files.southeastside.org/uploads/1/3/0/7/130775231/4643866.pdf
- http://files.sovietjewrymovement.org/uploads/1/3/0/7/130740458/110616fb5abc.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/juzopuzenafososokazulu.pdf
- https://cdn.shopify.com/s/files/1/0432/8580/7268/files/79761291833.pdf
- https://cdn.shopify.com/s/files/1/0430/6301/7629/files/lojobejuwe.pdf
- https://cdn.shopify.com/s/files/1/0433/6202/5624/files/28028162838.pdf
- https://cdn.shopify.com/s/files/1/0428/8525/1235/files/latirafotesemukepabol.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/xigemeziguvego.pdf
- https://cdn.shopify.com/s/files/1/0431/6885/8280/files/45834819902.pdf
- https://cdn.shopify.com/s/files/1/0438/9827/3944/files/sevimofudikorob.pdf
- https://cdn.shopify.com/s/files/1/0428/1620/9059/files/53407591367.pdf
- https://cdn.shopify.com/s/files/1/0434/4047/2229/files/dofilejukuloris.pdf
- https://cdn.shopify.com/s/files/1/0432/5969/1163/files/47427451666.pdf
- https://cdn.shopify.com/s/files/1/0432/3885/0719/files/wojewemujebobotezeruji.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000a8cc.bin` `5fc19e1feffe28f2e2214b23624176e485c9729dcc4b3f795ff4151f7eac2675`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA8CC	5516 bytes
`font_01_sfnt_off0000bb56.bin` `eca0f291177a389c47dcaeb56bd444e046ab6dfda79ff193b2aaa70f48856674`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBB56	15216 bytes
`font_02_sfnt_off0000eb77.bin` `786e4db6c2b8a63317ebd2e62e9313324635a3bcc9286cbba0aa59ea406ff707`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB77	16096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.