PDF malware analysis — malicious · 8b5d8d12c1e3afba

MALICIOUS

PDF

49.8 KB Created: 2020-08-22 04:32:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8c2871fee09049b6b685aa40935279e3 SHA-1: 7573ff9c1cf1b9dacaf6019fe9a1c51935a517df SHA-256: 8b5d8d12c1e3afbaecb69e4413ed2d2e6579ff854714d81920b62c842dcd2ab0

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.com/pify?keyword=video+helper+license+crack'. This URL is likely part of a phishing campaign designed to trick users into downloading malicious software or revealing sensitive information. The document also contains a large number of embedded links, many pointing to Shopify domains, which is characteristic of SEO link farm abuse for distributing malicious content. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=video+helper+license+crack
- http://files.rumah-indonesia.org/uploads/1/3/0/7/130775516/5c4fa49597596.pdf
- http://goribeluj.anchoragewindowcleaner.com/uploads/1/3/1/4/131453068/7713266.pdf
- http://files.deltasurveillance.com/uploads/1/3/1/6/131637529/peweludowib_somenifomofego_lelegitosope.pdf
- http://files.eastoncapital.com/uploads/1/3/2/7/132710794/lezupudinawoje-tonizurabebu.pdf
- https://cdn.shopify.com/s/files/1/0428/1306/3327/files/zejamudefifab.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gujogu.pdf
- https://cdn.shopify.com/s/files/1/0433/1057/9865/files/54998797381.pdf
- https://cdn.shopify.com/s/files/1/0431/7731/2411/files/91775403595.pdf
- https://cdn.shopify.com/s/files/1/0440/5349/5958/files/achyutashtakam_in_kannada.pdf
- https://cdn.shopify.com/s/files/1/0435/1187/3688/files/life_of_apollonius_of_tyana.pdf
- https://cdn.shopify.com/s/files/1/0434/6439/2866/files/januminularuwufetixivu.pdf
- https://cdn.shopify.com/s/files/1/0434/5259/6374/files/watch_american_reunion_free_online.pdf
- https://cdn.shopify.com/s/files/1/0430/9634/2695/files/moxojikifa.pdf
- https://cdn.shopify.com/s/files/1/0428/1604/5222/files/28483540294.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000075a7.bin` `2237b89d2b6f5b1dc302088a2f7f4ab159e5065488f88fa6b2e847cfd88f82fe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75A7	5188 bytes
`font_01_sfnt_off0000873a.bin` `717ffa4668addfdaad90d118cd22d80cae2cd21d80e7e7865c25e69816643272`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x873A	10696 bytes
`font_02_sfnt_off0000abfb.bin` `2402cfff880105a2fa3329dbea75fcffd9d9984efccc44c4611d2ba391613fad`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xABFB	3616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.