PDF malware analysis — malicious · 52b09e976138830a

MALICIOUS

PDF

49.5 KB Created: 2020-08-31 11:18:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 85d693a02d73c317cb2a68b9c68f5ef5 SHA-1: 63fd23e1f14412eef18e7ae3d3126d47be67b8a9 SHA-256: 52b09e976138830a5980c6fca596474481d8918eb51ca700e3307193fc1dc81d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'teenage mutant ninja turtles kisscartoon' and the redirector URL, suggesting a lure to attract users. The PDF also hosts a link farm, indicating an attempt to manipulate search engine results for malicious purposes. No scripts were extracted, but the presence of malicious links is a strong indicator of a phishing or redirection attack.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=teenage+mutant+ninja+turtles+kisscartoon
- https://static.usrfiles.com/ugd/accd1f_adb008fd376643d396c3042338d16481.pdf
- https://static.usrfiles.com/ugd/837d34_0475bb49c56e4516b14aa102271cce6f.pdf
- https://static.usrfiles.com/ugd/b8c837_bcf8ae4208574a229b816d0d778b054c.pdf
- https://static.usrfiles.com/ugd/b8c837_39b5e88116df490986064869769db061.pdf
- https://cdn.shopify.com/s/files/1/0430/8716/7637/files/sosugesolekujepivira.pdf
- https://cdn.shopify.com/s/files/1/0432/2122/1533/files/titivisapusadekifife.pdf
- https://cdn.shopify.com/s/files/1/0434/7199/5033/files/brochure_templates_for_powerpoint.pdf
- https://cdn.shopify.com/s/files/1/0428/3983/4791/files/physiology_practical_book_free_download.pdf
- https://cdn.shopify.com/s/files/1/0430/6590/1210/files/fazonamokameluvuwazosure.pdf
- https://static.usrfiles.com/ugd/b8c837_608b274125884702a3938e1ac8db3600.pdf
- https://static.usrfiles.com/ugd/73c254_72703af112a04c45932473ed64c0a791.pdf
- https://static.usrfiles.com/ugd/f967ac_da3fabf01b134bfb97445be78c29ba41.pdf
- https://static.usrfiles.com/ugd/b914b5_517cd5606b7342a2b995b4b2aab1c640.pdf
- https://static.usrfiles.com/ugd/b8c837_2be55c7e8b444c1fa019757a913632e9.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000076c0.bin` `7c7f3542b364dba5172709759f72b3452c6c54690fbce11d972bc83ab3aea4ce`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x76C0	5092 bytes
`font_01_sfnt_off000087f2.bin` `3fd87d7b0d0cede07aa72b7eaa95dc09198a4fec1f14bef30f0d24a690f03984`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x87F2	10024 bytes
`font_02_sfnt_off0000aa4f.bin` `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA4F	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.