PDF malware analysis — malicious · 58716b5cd10ae5a2

MALICIOUS

PDF

44.2 KB Created: 2020-08-04 00:56:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8d0f76ecff39305b54db8122a4234ee7 SHA-1: 22926b4d6ed520a2262627bb89e6c7c1385bbc44 SHA-256: 58716b5cd10ae5a2a6415f7e0b6e04c1b16943b1be04a733bc5bc50fbbac8d80

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/pify?keyword=alman+dili+pdf+yukle'. Additionally, it exhibits a PDF SEO link farm behavior, with numerous links to PDFs hosted on cdn.shopify.com and other domains. The document body contains similar URLs, suggesting the primary purpose is to drive traffic to external resources, potentially for malware distribution or SEO abuse.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=alman+dili+pdf+yukle
- http://files.lachicanalaundrypictures.com/uploads/1/3/1/4/131409305/104090.pdf
- http://files.thewoodroom.co.uk/uploads/1/3/1/1/131164488/sogopewajabadujug.pdf
- http://files.upwardcr.com/uploads/1/3/1/1/131163914/wuxedafa-lobob-nanasate-nalex.pdf
- http://files.paperppr.com/uploads/1/3/0/7/130739533/botukavexo.pdf
- http://files.wargamer-painter.com/uploads/1/3/1/0/131070523/9771f3f8fe0877.pdf
- https://cdn.shopify.com/s/files/1/0430/4096/4759/files/35910382775.pdf
- https://cdn.shopify.com/s/files/1/0449/5890/8584/files/lab_volt_manuals.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/doragewotupepefe.pdf
- https://cdn.shopify.com/s/files/1/0433/4593/6535/files/nodoga.pdf
- https://cdn.shopify.com/s/files/1/0432/3888/3495/files/alter_user_unlocked.pdf
- https://cdn.shopify.com/s/files/1/0430/8733/1481/files/8399501412.pdf
- https://cdn.shopify.com/s/files/1/0433/7732/8278/files/80363650869.pdf
- https://cdn.shopify.com/s/files/1/0432/5716/8027/files/legaputufojuduje.pdf
- https://cdn.shopify.com/s/files/1/0433/4636/2533/files/40806263759.pdf
- https://cdn.shopify.com/s/files/1/0436/3278/7609/files/kozatiziza.pdf
- https://cdn.shopify.com/s/files/1/0433/3066/6651/files/pipubuvawa.pdf
- https://cdn.shopify.com/s/files/1/0435/1960/6936/files/karozamotavegaz.pdf
- https://cdn.shopify.com/s/files/1/0430/0813/1233/files/wave_motion_physics.pdf
- https://cdn.shopify.com/s/files/1/0433/0160/1444/files/lizaxejaresevikuvuga.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ac9.bin` `663b00bfe2f86d661e2aa82fb57b63b45eea995c1077e6b6948fecf458377b14`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AC9	5068 bytes
`font_01_sfnt_off00007c08.bin` `1b28a2cf29a93fa8c0d4da0b44fc63362d9da2a0c04c5009a49be2e9d476591f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C08	12184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.