PDF malware analysis — malicious · 464cbf16d7129ccc

MALICIOUS

PDF

42.0 KB Created: 2020-08-05 06:17:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 412263b847271ab89108bb819b6eeed4 SHA-1: 5542d00dc6dcee52776f386a64e425cfdf3a3954 SHA-256: 464cbf16d7129ccc9054ce6506291e1d7b07d0b7b56af36b8bb5d643c4985732

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. The document also exhibits characteristics of a link farm, with numerous external PDF links, many hosted on Shopify. The primary malicious URL is a redirector that appears to be part of a lure for downloading a PDF, likely to lead to further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=barcelona+tourist+map+pdf+download
- http://files.nltbiblecollege.org/uploads/1/3/1/8/131856108/7450457.pdf
- http://files.naturallyprettynails.com/uploads/1/3/2/7/132710679/ninekuwowafoj-fagoxip.pdf
- http://tibipoko.finksdeli.org/uploads/1/3/1/6/131607131/4bebd87d8dd39dd.pdf
- http://files.shadysideofthetracks.com/uploads/1/3/1/4/131406762/9744250.pdf
- https://cdn.shopify.com/s/files/1/0434/0160/9366/files/70173502726.pdf
- https://cdn.shopify.com/s/files/1/0431/9746/4731/files/reference_images_for_3d_modeling.pdf
- https://cdn.shopify.com/s/files/1/0433/6674/4216/files/79592348717.pdf
- https://cdn.shopify.com/s/files/1/0432/1817/4107/files/157506206.pdf
- https://cdn.shopify.com/s/files/1/0433/8450/4474/files/53558345196.pdf
- https://cdn.shopify.com/s/files/1/0431/0843/4081/files/81693820601.pdf
- https://cdn.shopify.com/s/files/1/0437/4711/5157/files/kakikesafubigatukiv.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/vuxopikuxoxixu.pdf
- https://cdn.shopify.com/s/files/1/0434/1540/4695/files/40613478131.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/webomobituwisumepepaxifi.pdf
- https://cdn.shopify.com/s/files/1/0437/1392/1189/files/washington_fly_fishing_forum.pdf
- https://cdn.shopify.com/s/files/1/0433/2758/6457/files/vumenafukavi.pdf
- https://cdn.shopify.com/s/files/1/0433/3040/4502/files/apostrophe_worksheets_with_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0432/9360/6056/files/zofera.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000644c.bin` `44fb24ec6c60cdea2218f0e43a8d391320999f6c7f1bf9927a7c0525340f2252`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x644C	5444 bytes
`font_01_sfnt_off000076ca.bin` `129e2d8e0f22f94e27852c118c08ef8fcdabf581e119f8e7b5b76b76a3283c8f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x76CA	10628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.