PDF malware analysis — malicious · 40eaf01b74e15da7

MALICIOUS

PDF

41.6 KB Created: 2020-08-31 23:41:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 744daf99a57fe29de8728a6335ff5f89 SHA-1: 4776c66db0acdd47298f173b36edadc2e4f69465 SHA-256: 40eaf01b74e15da71cff4cd142c80ce555cbb9677bb7d183e926831c05430d67

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a redirector service. The document body, though heavily obfuscated, contains text related to Excel and a URL that appears to be a lure. The primary heuristic indicates that the PDF links to known malicious redirector infrastructure. The file is likely part of a phishing campaign aiming to redirect users to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=remove+duplicates+from+different+sheets+excel
- https://static.usrfiles.com/ugd/b8c837_fde0e5f9ecf94f0f8fa19f126ef7d74a.pdf
- https://static.usrfiles.com/ugd/de65f7_4fb7dfa1b3ac40bd97c85868bd68a20e.pdf
- https://static.usrfiles.com/ugd/b8c837_d46dfc5edf7f4833a626abf19ee6e198.pdf
- https://static.usrfiles.com/ugd/b8c837_668e81b89e9741bb83929efce7f71966.pdf
- https://static.usrfiles.com/ugd/de02f3_2da0e305d9684080ade399b7f42269dc.pdf
- https://static.usrfiles.com/ugd/b8c837_15186ec41161480583a176251b50e5bb.pdf
- https://static.usrfiles.com/ugd/6f7357_e7e1b84ad973451387fa47f3a939a0d4.pdf
- https://static.usrfiles.com/ugd/b8c837_0ba8fa64ff2146f39c01d83a7ed68bbf.pdf
- https://static.usrfiles.com/ugd/314c35_e5d006a72ef64fd096ddb7b5533497fe.pdf
- https://static.usrfiles.com/ugd/b8c837_62a5d968ecc846639d3de5cc1a6faf2a.pdf
- https://static.usrfiles.com/ugd/b8c837_73cdce11e2c0432dbed1274dcc5fa630.pdf
- https://static.usrfiles.com/ugd/b6bf5b_9acab77f56004019b21edd8c5a1e1247.pdf
- https://static.usrfiles.com/ugd/b8c837_16064dedc23c41148a2f399905ceec76.pdf
- https://static.usrfiles.com/ugd/b8c837_b023001898134fe8b6c924ffb909eb18.pdf
- https://static.usrfiles.com/ugd/f1780b_4ab687d2e95344c196e609319e357fd8.pdf
- https://static.usrfiles.com/ugd/b8c837_e3c088c13cb04a428c58dfef8b604f5f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000646a.bin` `09acb470b01d9537ae87fff37fc2997f01d80b7224f51208f469124b9def19e7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x646A	5532 bytes
`font_01_sfnt_off0000771c.bin` `434691ca4928db082466c4c69dff1784911ebbd3820f7a16b266a681b1b89e1b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x771C	10232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.