PDF malware analysis — malicious · 4b9f8241cd64177d

MALICIOUS

PDF

46.8 KB Created: 2020-08-05 16:46:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 48f18c499948f344e6ab4792ff216647 SHA-1: eb3fb01efcf045036c7c25ebfd6ff3106b581bf9 SHA-256: 4b9f8241cd64177d9f4b26793aabbf348cddbedbd3a7feaa7df0e1ff9eb12dd3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with a critical heuristic identifying a malicious redirector. The document body, though heavily obfuscated, contains a URL that points to a redirector service. This service likely leads to a malicious payload or phishing page. The presence of many links, including to Shopify, suggests a link farm or SEO poisoning attempt to disguise the malicious intent.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=synchronous+and+asynchronous+counters+in+digital+electronics+pdf
- http://veses.misskatiesdancestudio.com/uploads/1/3/0/7/130738732/1448529.pdf
- http://files.tampagoldendoodle.com/uploads/1/3/1/3/131383358/wokuwurede-putavetatug-nakovux-lujekiwetiw.pdf
- http://files.wildvalleyfarms.com/uploads/1/3/2/3/132303035/zefexuvil_xasem_figij_delofujozuve.pdf
- http://files.taylorbrothers.org/uploads/1/3/1/4/131407423/218196.pdf
- http://ritopove.mylendingleaves.com/uploads/1/3/0/8/130873851/59804d68d3806.pdf
- https://cdn.shopify.com/s/files/1/0445/5848/3620/files/can_am_owners_manual.pdf
- https://cdn.shopify.com/s/files/1/0427/9618/7815/files/gubode.pdf
- https://cdn.shopify.com/s/files/1/0429/1756/0473/files/volawawaperakeviverivu.pdf
- https://cdn.shopify.com/s/files/1/0436/4356/8278/files/tufokositoj.pdf
- https://cdn.shopify.com/s/files/1/0433/6179/6248/files/javewakaf.pdf
- https://cdn.shopify.com/s/files/1/0430/8893/7120/files/dunefudotorerokopaz.pdf
- https://cdn.shopify.com/s/files/1/0434/5597/1492/files/71505550439.pdf
- https://cdn.shopify.com/s/files/1/0428/1961/6935/files/kazoliz.pdf
- https://cdn.shopify.com/s/files/1/0434/5279/2982/files/procardia_xl_davis.pdf
- https://cdn.shopify.com/s/files/1/0430/8307/1650/files/kizatekojezitotipese.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kijajakunij.pdf
- https://cdn.shopify.com/s/files/1/0433/4852/5208/files/90038252904.pdf
- https://cdn.shopify.com/s/files/1/0430/0718/0954/files/38025857734.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000776d.bin` `f0fc86dbafb83a93e42fecb2a40e155fa98db590d4cb0b8918ed4d2afdf0a953`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x776D	5620 bytes
`font_01_sfnt_off00008a92.bin` `441b587897263eeced465336ba8d4902652eebcfc271606fc2e563c5ab6da7d3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A92	10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.