PDF malware analysis — malicious · 5296c2d686b393ec

MALICIOUS

PDF

43.5 KB Created: 2020-08-03 09:05:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 980283e3cdcfe9dbe5be6fb79d169c17 SHA-1: 712ddf587639ce8ca3b9c277d1ef1fcde746c632 SHA-256: 5296c2d686b393ec612933823189880209327ccc97961a5021f4c49f91d9c5bc

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/pify?keyword=windows+command+line+cheat+sheet'. Additionally, it exhibits characteristics of a PDF SEO link farm, with numerous embedded links to PDF files hosted on Shopify. The document body, though heavily obfuscated, contains text that, combined with the 'SE_CLIPBOARD_COMMAND_LURE' heuristic, suggests the user is instructed to copy and paste content into a command-line interface. This points to an attack pattern where the user is tricked into executing commands, likely to download and run a secondary payload.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=windows+command+line+cheat+sheet
- http://files.nokillhuntsville.com/uploads/1/3/1/4/131455883/jalupi.pdf
- http://files.daedreamnh.org/uploads/1/3/2/6/132680986/xizarovi.pdf
- http://files.e67agency.com/uploads/1/3/1/8/131871778/b60f71cdf4cd.pdf
- https://cdn.shopify.com/s/files/1/0433/7372/3800/files/watobubam.pdf
- https://cdn.shopify.com/s/files/1/0431/2029/6090/files/totodimiwekosisifizomor.pdf
- https://cdn.shopify.com/s/files/1/0439/2180/1371/files/kwikset_smartcode_909.pdf
- https://cdn.shopify.com/s/files/1/0428/1470/1735/files/30525935504.pdf
- https://cdn.shopify.com/s/files/1/0428/7011/2423/files/defulibupezozega.pdf
- https://cdn.shopify.com/s/files/1/0439/4686/8891/files/13118280399.pdf
- https://cdn.shopify.com/s/files/1/0436/4392/8726/files/91265471626.pdf
- https://cdn.shopify.com/s/files/1/0431/2632/5402/files/ladisoropom.pdf
- https://cdn.shopify.com/s/files/1/0431/8153/9483/files/roxaxurujaw.pdf
- https://cdn.shopify.com/s/files/1/0432/6424/5922/files/wejiz.pdf
- https://cdn.shopify.com/s/files/1/0434/6868/5464/files/75710037246.pdf
- https://cdn.shopify.com/s/files/1/0431/6577/8080/files/84395891472.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006104.bin` `5e1ea5303a82d5971d18751e613c3d1ac4f385f83fcc98d85ba4f9bd4b49e020`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6104	5188 bytes
`font_01_sfnt_off00007294.bin` `1d5f981174d2625ceac470a051a316993f207f3446f08f0f8067404d6119f2a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7294	14940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.