PDF malware analysis — malicious · 52641ed04685bb7e

MALICIOUS

PDF

68.6 KB Created: 2020-08-06 08:04:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 849e390cd3aaf56bc645b4b5bdb2b236 SHA-1: 7cccc2a713c486f0c81debaa43088e4deaba2091 SHA-256: 52641ed04685bb7efe230ad488b830bee5fd66956a6c4f31d300d6faf362f9ef

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to its structure, which includes a large number of embedded links to external PDF files, characteristic of a link farm. One of these links, 'https://ttraff.ru/pify?keyword=rebuild+air+cooled+vw+engines+hp+255+pdf', points to known malicious redirector infrastructure. The document body contains garbled text along with the same URL, suggesting a lure or obfuscation attempt. No scripts were extracted, and the primary malicious activity observed is the redirection via the malicious URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=rebuild+air+cooled+vw+engines+hp+255+pdf
- http://files.lakewashingtonsaddleclub.org/uploads/1/3/1/8/131857916/64e9fa.pdf
- http://xedux.conwytours.net/uploads/1/3/1/3/131379833/7554b3e571332.pdf
- http://files.immune-tolerance.fr/uploads/1/3/0/7/130739233/bae3e7a7.pdf
- http://files.blacksheeprugby.com/uploads/1/3/0/7/130775866/7566f.pdf
- https://cdn.shopify.com/s/files/1/0437/1785/3335/files/avi_to_wmv.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/99914628395.pdf
- https://cdn.shopify.com/s/files/1/0427/5198/3772/files/pepenirexoxodukafifesadar.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/15501301831.pdf
- https://cdn.shopify.com/s/files/1/0434/5564/3813/files/55880133837.pdf
- https://cdn.shopify.com/s/files/1/0431/5512/8477/files/butox.pdf
- https://cdn.shopify.com/s/files/1/0433/2139/3320/files/97137143555.pdf
- https://cdn.shopify.com/s/files/1/0431/6885/8280/files/63924904684.pdf
- https://cdn.shopify.com/s/files/1/0432/7230/6843/files/fixorasadipukogukixu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000a32f.bin` `6fdb61d240193fb116c1b0573015fb1ecb1f96ad2228b5a36100810bda13bf83`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA32F	4416 bytes
`font_01_sfnt_off0000b297.bin` `2abd467896e0d6315d9f47e8ae3c05e5fe09d67c56db90c9beda702b2d78657c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB297	5972 bytes
`font_02_sfnt_off0000c703.bin` `67a56fbbe69d653d6e7da89f152e08d0f59efb8ac75f3bcff3bc16e792a83542`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC703	12716 bytes
`font_03_sfnt_off0000efe9.bin` `10bdf1da1f14de10963fa7e0db0c3c3b39de0ddf5d1d591acf32bdd77afa173d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFE9	16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.