PDF malware analysis — malicious · 87497ea5f6ee977e

MALICIOUS

PDF

43.5 KB Created: 2020-08-29 06:54:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9f6c1a19d5c6d7079e5b49312b6f771d SHA-1: cbb086af51de8ed71438deb574d2fc550753f999 SHA-256: 87497ea5f6ee977e30cfae2eae4bbeec896ec7bc861abcde6e2f338cf5e60c41

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, with the primary link pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the same malicious URL. The presence of a link farm and a malicious redirector suggests an attempt to lead the user to a phishing or malware distribution site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=girl+stolen+pdf
- https://cdn.shopify.com/s/files/1/0435/0004/4440/files/no_ads_ampere_meter_apk.pdf
- https://cdn.shopify.com/s/files/1/0431/6528/6564/files/wukukoxurotanedumib.pdf
- https://cdn.shopify.com/s/files/1/0431/5647/1959/files/64508526431.pdf
- https://cdn.shopify.com/s/files/1/0429/9508/9571/files/telecharger_bescherelle_conjugaison.pdf
- https://static.usrfiles.com/ugd/b8c837_4f02072d5c3d403f93d38896f2eba95e.pdf
- https://static.usrfiles.com/ugd/b8c837_c558f0fe94124d7e8cb83514f51fbdba.pdf
- https://static.usrfiles.com/ugd/b8c837_03bb5753474e47d880010b5f37b57099.pdf
- https://static.usrfiles.com/ugd/b8c837_6a190b5f02624d27b0ad5895c3efbb94.pdf
- https://static.usrfiles.com/ugd/b8c837_1512b562c6d04019a44967862eb7b91e.pdf
- https://static.usrfiles.com/ugd/b8c837_d96dc23e41924441aee5257b99493eda.pdf
- https://static.usrfiles.com/ugd/b8c837_2ebcb851fb5c48ef8590debfefe30567.pdf
- https://static.usrfiles.com/ugd/b8c837_4505f707abef4a2eba8713b00a831b7b.pdf
- https://static.usrfiles.com/ugd/b8c837_4831c848c103487084812b78947cafe4.pdf
- https://static.usrfiles.com/ugd/b8c837_f4aaed9214814f42bbb342f784210ddc.pdf
- https://static.usrfiles.com/ugd/b8c837_5b344f4397ee4e2995bf1dd67e41fa91.pdf
- https://static.usrfiles.com/ugd/b8c837_e7384fd29ade4caf967648eed7c28ad5.pdf
- https://static.usrfiles.com/ugd/b8c837_40cc6f6f8651485995aa7e927b10234e.pdf
- https://static.usrfiles.com/ugd/b8c837_0425bbb4481e48e0a3c28e4ead617b81.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000069af.bin` `2c0421e9110e0dfec715a76099a5ac56c13ed111412714718d575e7c9e02664a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69AF	4856 bytes
`font_01_sfnt_off00007a49.bin` `db7125b8837fbb618e32941c68881d8351c5875351b2d20d0fab02844ea2c079`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A49	11972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.