PDF malware analysis — malicious · 8947ba2758539f06

MALICIOUS

PDF

86.5 KB Created: 2020-10-17 01:41:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 41c72f24305bd47e51813c060eff719e SHA-1: 63ded912491013ca3aeea36e697b374eb61bb662 SHA-256: 8947ba2758539f0600c02fab82e9918a7b811ef29d9ec13f9ce37e9346aef49c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, which is also present in the document body. This link, disguised as a PDF about agile software development, likely leads to a malicious site. The PDF also contains a large number of external links, suggesting a link farm or redirection strategy. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/123?keyword=what+is+agile+software+development+pdf
- https://xumabilere.weebly.com/uploads/1/3/1/1/131163638/xigaguzi-kowizelajofo.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/09b03b.pdf
- https://cdn-cms.f-static.net/uploads/4365621/normal_5f87004d9e9d4.pdf
- https://cdn-cms.f-static.net/uploads/4366360/normal_5f88b4b4b8e06.pdf
- https://cdn-cms.f-static.net/uploads/4377120/normal_5f8a1e83dbd49.pdf
- https://cdn-cms.f-static.net/uploads/4366344/normal_5f872c0c2a7be.pdf
- https://cdn-cms.f-static.net/uploads/4366388/normal_5f8863b06b427.pdf
- https://cdn-cms.f-static.net/uploads/4369516/normal_5f8a120dc2574.pdf
- https://cdn.shopify.com/s/files/1/0430/3850/7169/files/redafalujamobenuro.pdf
- https://cdn.shopify.com/s/files/1/0500/2743/0059/files/56281230216.pdf
- https://cdn.shopify.com/s/files/1/0430/7566/6073/files/white_mage_ffxiv_glamour.pdf
- https://cdn.shopify.com/s/files/1/0476/7350/8006/files/redstone_engineering_degree.pdf
- https://cdn.shopify.com/s/files/1/0266/8639/0468/files/papo_la_bala_wiki.pdf
- https://cdn.shopify.com/s/files/1/0440/4002/8325/files/solar_powered_tractor_trailer.pdf
- https://cdn.shopify.com/s/files/1/0484/3506/9096/files/xobevotonif.pdf
- https://cdn.shopify.com/s/files/1/0433/6739/9575/files/pampero_comfisafe_car_seat_manual.pdf
- https://cdn.shopify.com/s/files/1/0497/5093/3658/files/72988399811.pdf
- https://cdn.shopify.com/s/files/1/0501/2337/4752/files/69783487929.pdf
- https://cdn.shopify.com/s/files/1/0430/9473/7045/files/lg_spirit_4g_lte_manual.pdf
- https://cdn.shopify.com/s/files/1/0501/6407/2613/files/50979720118.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001156a.bin` `98c085aabc87a3a1c2c8e1621e18617c357dcb2760d0f1c05a836f8b180b82ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1156A	5620 bytes
`font_01_sfnt_off00012882.bin` `e4602d5e48c25503303c1c2fe0ae5b7499109b460e9c07ca31e5a494e86a9319`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12882	10572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.