PDF malware analysis — malicious · 36a939338e5a6e54

MALICIOUS

PDF

48.3 KB Created: 2020-08-02 10:15:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 183037acafe21b908d4ecc0114afe328 SHA-1: c4a1ce469e8191b53a97a9b6ef3abf0c0cb4d17c SHA-256: 36a939338e5a6e5447ec3973ff52060b86a2242e0afd127b34f1991ef0e029e6

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=body+beast+schedule+pdf'. Additionally, it features a large number of embedded external PDF links, many hosted on Shopify, suggesting a link farm or SEO poisoning attempt. The presence of a visual download button lure further supports the malicious intent of redirecting users to potentially harmful content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=body+beast+schedule+pdf
- http://files.ithacaymca.com/uploads/1/3/1/8/131871602/tavunerutivog.pdf
- http://files.empowerednation.net/uploads/1/3/1/4/131453907/jimus-basoxetu-siwuxojos.pdf
- http://files.itsallfunandjames.com/uploads/1/3/1/4/131482930/2755911.pdf
- http://files.lohministriesnb.org/uploads/1/3/1/6/131607131/37407.pdf
- https://cdn.shopify.com/s/files/1/0432/6945/6028/files/74696624990.pdf
- https://cdn.shopify.com/s/files/1/0431/2167/2341/files/todufavejovevadi.pdf
- https://cdn.shopify.com/s/files/1/0430/6799/8362/files/dimisinosu.pdf
- https://cdn.shopify.com/s/files/1/0431/1416/8487/files/casio_fx-_115.pdf
- https://cdn.shopify.com/s/files/1/0431/2884/8538/files/layers_of_fear_achievement_guide.pdf
- https://cdn.shopify.com/s/files/1/0433/6749/7884/files/2015_kia_optima_owners_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/1448/7190/files/mesevixi.pdf
- https://cdn.shopify.com/s/files/1/0428/7568/2972/files/xefukiwi.pdf
- https://cdn.shopify.com/s/files/1/0428/2885/7503/files/fifanexawuverop.pdf
- https://cdn.shopify.com/s/files/1/0428/6958/8135/files/nepepuregubixi.pdf
- https://cdn.shopify.com/s/files/1/0434/6406/5188/files/68258196255.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007d69.bin` `7b47d35eeb794b895fbd0ba31e4fc6b9ac1dbd632a66ca0f41b82d636eb4610d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D69	5440 bytes
`font_01_sfnt_off00008ff0.bin` `bbe2bcd8b3f484cb154d071fab4c04295c54ee8c4ebf0781329947370210e873`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8FF0	10740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.