PDF malware analysis — malicious · 9bd478ed890cde7d

MALICIOUS

PDF

41.6 KB Created: 2020-09-02 13:54:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 67a41cd29590c498b3c635184f2ddffe SHA-1: 7107811423a1a6b8b4b130fdfad386bbfbbdee42 SHA-256: 9bd478ed890cde7ddca629e5f54be19c2634d0d5cdb45f3fb9b8630642b1ab05

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link that redirects to known malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text suggesting a lure related to 'album song tamil' and includes the malicious URL. The PDF_SEO_LINK_FARM heuristic indicates the presence of numerous external links, likely part of a link farm designed to improve search engine ranking for malicious content. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=album+song+tamil
- https://static.usrfiles.com/ugd/c3f88d_a76a7f4df5a74cd79ba9a16792a8f1e0.pdf
- https://static.usrfiles.com/ugd/e481ce_b3346b6a8235471c92c6aaeb87058cde.pdf
- https://static.usrfiles.com/ugd/f103bb_e2c0ab4c21254c4abbcf5784951ce234.pdf
- https://static.usrfiles.com/ugd/c83fdb_9f1521e3e8c14b9880e23dc092448397.pdf
- https://static.usrfiles.com/ugd/6cf392_3e1dbc28951a485381d63e65169ec3b9.pdf
- https://static.usrfiles.com/ugd/b8c837_386c1266962646c6bf52768495d0dd1b.pdf
- https://static.usrfiles.com/ugd/f2c1dc_2cb5388f43bc4a2191e787c65602ccd8.pdf
- https://static.usrfiles.com/ugd/9a242c_b5294372232346f69a75e78e75e3fdb6.pdf
- https://cdn.shopify.com/s/files/1/0430/8385/8074/files/66822314599.pdf
- https://cdn.shopify.com/s/files/1/0447/3847/8229/files/biodata_format_for_marriage_file.pdf
- https://cdn.shopify.com/s/files/1/0433/4908/2264/files/kowuxowivemujovopigug.pdf
- https://cdn.shopify.com/s/files/1/0433/0582/8520/files/animedroid_s2_apk_sin_publicidad.pdf
- https://cdn.shopify.com/s/files/1/0433/6451/6005/files/85294266158.pdf
- https://cdn.shopify.com/s/files/1/0433/3663/0422/files/fajureborixelagizotofa.pdf
- https://cdn.shopify.com/s/files/1/0431/7731/2411/files/98431286443.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000486c.bin` `8d6bf8d1f24104bdf27ba5ca8ba91c3968ec10461fc53a9a08317cc348beaaa3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x486C	5040 bytes
`font_01_sfnt_off00005980.bin` `521e41ed28e31878b0f60af0ccd0e74ac3376659bbf1e2e6e7a9001e63639359`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5980	9680 bytes
`font_02_sfnt_off00007a99.bin` `1df41416ece054d3cca32f135e48dc95f4d9c8a2bff4ba4edba1d14e21aabef6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A99	18776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.