PDF malware analysis — malicious · 485b62f15430e289

MALICIOUS

PDF

55.5 KB Created: 2020-09-16 21:12:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 76c2d180d3907aa591b3e16d8b75c483 SHA-1: 2ef47efa907b1b38719920aece28e189885b2916 SHA-256: 485b62f15430e289686f786d3715a53dc8bfa7122c71ccffe2a9bda7d1d75dfd

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a redirector service. The document body, though heavily obfuscated, contains text related to movie downloads and a URL that appears to be the primary lure. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms that the primary link leads to known malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=south+movie+hindi+dubbed+download+pagalworld
- https://cdn.shopify.com/s/files/1/0432/1358/6596/files/47429990433.pdf
- https://cdn.shopify.com/s/files/1/0465/9393/3477/files/bootstrap_form_error_rails.pdf
- https://cdn.shopify.com/s/files/1/0482/3770/7416/files/b._ed_form_2018_rajasthan_admit_card.pdf
- https://cdn.shopify.com/s/files/1/0437/5986/1912/files/fosafisilanatux.pdf
- https://cdn.shopify.com/s/files/1/0432/1198/0964/files/jepewodapexi.pdf
- https://cdn.shopify.com/s/files/1/0429/5399/8502/files/airtel_tv_mod_apk_xda.pdf
- https://590879d8-4a6e-464d-aacb-5d32f7452525.filesusr.com/ugd/e49726_3ed22430aa5c482bb1d2cc41211e22f2.pdf?index=true
- https://96ae8090-16c8-4aaa-94af-8adcc5c20a11.filesusr.com/ugd/47e66e_6d525356b87549b5b6dbe30c9128b001.pdf?index=true
- https://f02e3a86-775b-444b-aff9-8d25843daf48.filesusr.com/ugd/de60da_800f6474165a4d3e8de21a30b7de38bb.pdf?index=true
- https://0051bdad-89b6-4540-9e97-228fe4130456.filesusr.com/ugd/fdd6c2_cdf8214183db45bb906d732e216f661f.pdf?index=true
- https://a839446c-33f1-4011-8cec-647f2cd88f45.filesusr.com/ugd/38eac1_63f14b3b257f466ba019821bac55fdea.pdf?index=true
- https://51bddec3-22d8-4fa6-9aed-8c02240b040c.filesusr.com/ugd/a382ee_c41b8a6d14ca41128a5f1d0cae42e215.pdf?index=true
- https://666b369a-6e16-4dac-a597-cef2208a7e65.filesusr.com/ugd/5f5755_6096d48c9d3b41bd9c971111ed6c6f22.pdf?index=true
- https://81d43b2d-5142-4730-aa83-00d8a29eeb39.filesusr.com/ugd/417718_14f7668d893840e5bb0b1754e3be8e46.pdf?index=true
- https://3c813fc0-aea4-4762-9767-8a119c430612.filesusr.com/ugd/e3325f_32bdd1a9d0314146af17884c90f1e73a.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009a2b.bin` `e619600408e7dec11954faa3089a4f0e4ef2b6da9e1059976c33348d6e906a56`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9A2B	5588 bytes
`font_01_sfnt_off0000ad16.bin` `dbe7247f2836ecf90b944724493e49664aff76ab5f8d5add87b62f9f24b9999c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAD16	10324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.