PDF malware analysis — malicious · 760a9092df264956

MALICIOUS

PDF

54.7 KB Created: 2020-09-06 23:11:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 37a5bd8e8591b26482033701564ec128 SHA-1: 8619d8b3793ce2a218a039ec5c12bbb4d7a89858 SHA-256: 760a9092df26495643c5fd2e8e698a2efdbe99d7a11888d746d3c095417c25cd

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the URL and a lure related to a '2016 bmw x3 navigation manual'. The PDF_SEO_LINK_FARM heuristic also indicates the presence of numerous external links, suggesting a link farm for SEO manipulation or distribution. The SE_DOWNLOAD_BUTTON heuristic further supports the lure-based nature of the document.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=2016+bmw+x3+navigation+manual
- https://cdn.shopify.com/s/files/1/0469/0775/2608/files/bexamivozerolujefaf.pdf
- https://cdn.shopify.com/s/files/1/0433/4141/4552/files/lizimosawi.pdf
- https://cdn.shopify.com/s/files/1/0434/0524/6631/files/aluminium_phosphide_poisoning.pdf
- https://static.usrfiles.com/ugd/9b7d8a_c08dc5966b684951a9a78849c36b47a1.pdf
- https://static.usrfiles.com/ugd/6290de_21ad41ad0b5142b68f010b254b4c42e4.pdf
- https://cdn.shopify.com/s/files/1/0434/5928/1061/files/phonetic_transcription_symbols.pdf
- https://cdn.shopify.com/s/files/1/0430/9850/5369/files/35087905648.pdf
- https://cdn.shopify.com/s/files/1/0431/3877/7249/files/13829206645.pdf
- https://cdn.shopify.com/s/files/1/0434/0921/1549/files/67342595842.pdf
- https://cdn.shopify.com/s/files/1/0436/6699/7398/files/dateutil_python_3._4_windows.pdf
- https://cdn.shopify.com/s/files/1/0432/5975/6702/files/karizowimigafur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006876.bin` `73e294544caad37c0606d4c8b6c236b7c1454c936f2d34b23ac4b45b8f9ebcc3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6876	5640 bytes
`font_01_sfnt_off00007bb1.bin` `e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BB1	1800 bytes
`font_02_sfnt_off0000843f.bin` `bdafa3998f4acb380ee8c9c90446665cad6a87594d8edc7977f37933987b31c9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x843F	13404 bytes
`font_03_sfnt_off0000aee7.bin` `1181c7146d09088db50f0704e4b75e6c0f69b368c03f96d6307fce71d3a1afdc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAEE7	9360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.