PDF malware analysis — malicious · 8db022bf11830f66

MALICIOUS

PDF

56.2 KB Created: 2020-07-27 22:25:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 79f00d203d62e4b94db3538f41792c41 SHA-1: 432bbd5a8d97cf89e20fed861e35c5a51081189e SHA-256: 8db022bf11830f669fdd000cd8f24e69d6e710c5ce706270b068aed9bcf9b6d0

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on cdn.shopify.com. One of the primary links, ttraff.ru, is identified as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to a 'data scientist resume template latex', indicating a social engineering attempt to drive traffic to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=data+scientist+resume+template+latex
- http://files.glassbynanc.com/uploads/1/3/0/9/130969169/senumit_lejegofusasow.pdf
- http://files.organichealthsolutions.org/uploads/1/3/1/8/131857758/00b1c.pdf
- http://files.beamstudioart.com/uploads/1/3/2/7/132740338/f1a88b33.pdf
- http://files.lightsoutlet.net/uploads/1/3/1/6/131606092/danalub-nowevewunumuz-pigebesibebo.pdf
- http://files.julietavitullo.com/uploads/1/3/2/8/132814342/124073.pdf
- https://cdn.shopify.com/s/files/1/0427/6381/3020/files/vusoxumakaruwasiv.pdf
- https://cdn.shopify.com/s/files/1/0432/2151/6448/files/15297256620.pdf
- https://cdn.shopify.com/s/files/1/0440/9150/6840/files/76402898127.pdf
- https://cdn.shopify.com/s/files/1/0434/3506/5510/files/91711149680.pdf
- https://cdn.shopify.com/s/files/1/0430/0754/1401/files/lurudewapanu.pdf
- https://cdn.shopify.com/s/files/1/0429/9682/6273/files/bezoxobirumeguzozekome.pdf
- https://cdn.shopify.com/s/files/1/0430/5525/1605/files/vedabimigakasot.pdf
- https://cdn.shopify.com/s/files/1/0439/9228/5342/files/tazevebafibakus.pdf
- https://cdn.shopify.com/s/files/1/0428/2531/8563/files/23882761827.pdf
- https://cdn.shopify.com/s/files/1/0435/4703/3752/files/pizotunagimu.pdf
- https://cdn.shopify.com/s/files/1/0432/7673/0533/files/66065852799.pdf
- https://cdn.shopify.com/s/files/1/0430/5901/9933/files/74405314271.pdf
- https://cdn.shopify.com/s/files/1/0429/7523/2153/files/73949988396.pdf
- https://cdn.shopify.com/s/files/1/0431/5955/2155/files/munabofalosulujafopigebu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009a53.bin` `f1f4a3024c13f14fa37d1aab46a2a677a9dabefbbd8910e34eac15b0e46ea361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9A53	4920 bytes
`font_01_sfnt_off0000aaf0.bin` `81572752b2380ea746f37bd3106a11b137e3caa92bbb590c3f9e005c9af54e55`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAAF0	12624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.