PDF malware analysis — malicious · 5129878c3dc9e893

MALICIOUS

PDF

41.0 KB Created: 2020-08-30 09:11:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4830c13d4f582acce5f3085e4b1a2bcd SHA-1: 56c40fbf959356f8abac98208c7cd28282d2f12e SHA-256: 5129878c3dc9e89367ec4d666e6410428e8d4d7578adc368aeb03b7661da2a6c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a mass of external links, masquerading as a study guide. One of the primary links, 'https://ttraff.ru/wix?keyword=certified+information+systems+security+professional+study+guide', is flagged as a malicious redirector. The document body is heavily obfuscated, but the presence of numerous links and the malicious redirector strongly suggest a phishing or malware distribution attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=certified+information+systems+security+professional+study+guide
- https://static.usrfiles.com/ugd/b8c837_da2133d936164a218f79a8d2f4a3d882.pdf
- https://static.usrfiles.com/ugd/c068f8_fbcc1cd7172a4cfd89ce7eb05fa6572a.pdf
- https://static.usrfiles.com/ugd/b28561_7397bcf0175c4821abf2b89858d9712f.pdf
- https://static.usrfiles.com/ugd/4c1554_671ffc96d03d4d70bfbe363166b3177f.pdf
- https://static.usrfiles.com/ugd/ae059d_042f1d3e89c74111ab8263253829a787.pdf
- https://cdn.shopify.com/s/files/1/0433/0877/7637/files/zomiwosatibodog.pdf
- https://static.usrfiles.com/ugd/b8c837_ce3a433c7964429c889da22b82d5d1e8.pdf
- https://static.usrfiles.com/ugd/289c5e_36cff3cc26bd4fe99ea506a2871a33fe.pdf
- https://static.usrfiles.com/ugd/b8c837_2980f03b62a040bf9d78b0240be816ca.pdf
- https://static.usrfiles.com/ugd/69b86f_d87e171114184d2f9981aae67dc1cb24.pdf
- https://static.usrfiles.com/ugd/b8c837_6c0db040d4b84e08b5a1b5f7319341a1.pdf
- https://static.usrfiles.com/ugd/c345b0_4dad720ddcf04f3eb2f971c5fed64a46.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006009.bin` `566c48e3c9c56ab744cc7ff7f08a3e003d63ee7c6f7ffbe72f4e0d4e2c657873`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6009	5484 bytes
`font_01_sfnt_off0000729a.bin` `8f1ed486acc0e6452b6631e60c3ff78e759af734c0a63400c17ed9e2a1f11d36`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x729A	10564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.