PDF malware analysis — malicious · 4149ced3a1f0b95f

MALICIOUS

PDF

40.0 KB Created: 2020-07-12 02:59:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5d233cf863e7708a486f9b7fe631c947 SHA-1: 8c2a159d00ea6306fab7911d50d89b63e61e9dbd SHA-256: 4149ced3a1f0b95fa6d115e2360f4881f127c99074f98d3a454da19996e6ea17

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with a critical heuristic firing for a PDF link farm. One of these links, 'https://ttraff.com/pify?keyword=garry+kasparov+magnus+carlsen', is identified as a malicious redirector. The document body contains garbled text and the embedded links appear to be part of an SEO manipulation scheme or a lure to distribute further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=garry+kasparov+magnus+carlsen
- http://files.academy522.com/uploads/1/3/1/4/131406835/7440398.pdf
- http://files.cbdrumstudio.com/uploads/1/3/0/7/130739883/347e33.pdf
- http://files.affirmingleadership.com/uploads/1/3/1/4/131406433/jekureli.pdf
- https://cdn.shopify.com/s/files/1/0430/2657/9610/files/nolezunowiwolo.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/bewewolifokolugetu.pdf
- https://cdn.shopify.com/s/files/1/0429/5278/6074/files/64157736898.pdf
- https://cdn.shopify.com/s/files/1/0430/6678/5949/files/viziwevomenemuxe.pdf
- https://cdn.shopify.com/s/files/1/0433/9105/8070/files/55451665430.pdf
- https://banaxog.files.wordpress.com/2020/06/xejilurusewibisug.pdf
- https://bebeleg.files.wordpress.com/2020/06/27693832464.pdf
- https://rujobule.files.wordpress.com/2020/06/vosubipuviki.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/77363931764.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/23281911610.pdf
- https://cdn.shopify.com/s/files/1/0430/8343/2096/files/54321748524.pdf
- https://cdn.shopify.com/s/files/1/0431/9775/9643/files/desijedesefili.pdf
- https://cdn.shopify.com/s/files/1/0430/7874/6261/files/somuwidepojikejime.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/59526866216.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/47184882359.pdf
- https://cdn.shopify.com/s/files/1/0430/4489/6925/files/jutedopaboguwidosakukor.pdf
- https://cdn.shopify.com/s/files/1/0431/0610/7552/files/749144574.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e82.bin` `abaf8b3bdd7d99ae53d606b0154de807f55f7018a14ef7db8bd767ed3b603989`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E82	5264 bytes
`font_01_sfnt_off00007069.bin` `b5f78033d51a782acbcaf03dc797ebc8fe3d3a4ff4ea54c7a5ba3e36985ce65a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7069	10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.