PDF malware analysis — malicious · 358a2fe6f64cfd61

MALICIOUS

PDF

42.3 KB Created: 2020-09-18 17:52:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4b583f5234e34b3bd1c4429782f05905 SHA-1: b2e1eea75857938ff6b548df93d26903754bf513 SHA-256: 358a2fe6f64cfd61efd617f3eaf34550bc17abaa529e933c05c068065c30df3b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm designed to appear as chemical process diagrams, but the primary link redirects to a malicious URL. This indicates a social engineering tactic to trick users into visiting a potentially harmful site. The file's structure and embedded links suggest it is part of a phishing or redirection campaign.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=diagramas+de+procesos+quimicos
- https://d30ff34d-4799-49c5-a30a-31bf78890df8.filesusr.com/ugd/48f461_54ff4c83d87b4f25989e151c296fd224.pdf?index=true
- https://ce5f69dd-5b98-4b44-b932-c9b398781327.filesusr.com/ugd/80685d_764502f5831147d78a2c4c205b6c8395.pdf?index=true
- https://ecf8a9c3-226a-4ac1-bb06-2cbfd86487d4.filesusr.com/ugd/12daa7_72acdf85170f4173855661b621901020.pdf?index=true
- https://a25fdfab-557c-463c-a029-68d8bc1dc47c.filesusr.com/ugd/38062a_f8328a4536f34ea39c3398c69976db71.pdf?index=true
- https://f185348f-f785-49bc-9aac-0fc397c67e3c.filesusr.com/ugd/bbd3cf_9ef0f3ae387249d58f9761c8d129b675.pdf?index=true
- https://7240c9a3-b142-429f-b249-175f7df1b4d8.filesusr.com/ugd/b6bf5b_36291e4b7466432f8c43724a3c7ab8fe.pdf?index=true
- https://04f87d15-244e-483c-b3e2-5b5504d1655b.filesusr.com/ugd/71fd01_9c43da7126e84c719792a1b9f8d48368.pdf?index=true
- https://fa9e9811-6796-4f22-bade-297431563583.filesusr.com/ugd/3bf302_1097fa5cdc7e427dbb989edeb07cd666.pdf?index=true
- https://4f0a3e1a-18e5-4a36-b053-26617cc79d75.filesusr.com/ugd/e2a635_7c1d027b96f54c5b8fab1d20216ea109.pdf?index=true
- https://d144dfe7-fc78-4dfd-92ab-4378174d4c6b.filesusr.com/ugd/4a2613_6b16fb60cb8547f787df22500b9a8e4c.pdf?index=true
- https://99120644-a416-45b4-9ad4-c6ec35c79779.filesusr.com/ugd/694d5d_e64ecfb28b804d1fbc0b0781b2210764.pdf?index=true
- https://bce88572-a13b-4044-8e0f-01bd1d1ff395.filesusr.com/ugd/668a47_5b95788bd0434ff1802cb36586d388f3.pdf?index=true
- https://f6a3af13-919b-4369-94fb-9ee259ae6fe8.filesusr.com/ugd/1c8c1e_dca6eab6847d4c8aa6e5427627cf785d.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006473.bin` `46b2a0ab8b6a314e601c0cc980fc1220832c28096d0db1cef6aefabb9c3267b9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6473	5484 bytes
`font_01_sfnt_off00007705.bin` `b9c27c58786752d5b6729c4ccad095933a37efef69b82527fc7dc36a86194024`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7705	11428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.