PDF malware analysis — malicious · 9cb6704bb78b3447

MALICIOUS

PDF

51.4 KB Created: 2020-09-18 19:39:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 489c50901fbe48c04f0d54504a05a096 SHA-1: c037e974d3c82a4f434c5403a7507a73874c734c SHA-256: 9cb6704bb78b344799a1e1e0a6cdf6146e414b09ae1d12968edd1049094f0597

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link disguised as a 'Mobile Legends Rafaela guide' which redirects to a malicious URL. This is further supported by heuristics indicating a malicious redirector link and a PDF link farm, suggesting a phishing or malware distribution attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=mobile+legends+rafaela+guide
- https://cdn.shopify.com/s/files/1/0484/3972/2138/files/vonezuwosojawedel.pdf
- https://cdn.shopify.com/s/files/1/0437/8551/9261/files/input_output_machines_grade_7_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/86187089948.pdf
- https://cdn.shopify.com/s/files/1/0484/7088/4502/files/kubiradixesudene.pdf
- https://cdn.shopify.com/s/files/1/0431/4890/2554/files/kuwipojozedawikefov.pdf
- https://54e7ad06-c532-4192-95f9-e6f073189ccd.filesusr.com/ugd/368de4_93dda8253fd6467f86a55305b0ffa9f6.pdf?index=true
- https://33007095-bfa4-4e93-9ec9-a8ee12d178a8.filesusr.com/ugd/003b86_7f3058c8e32b48c5bbc1c97ebc7dc3c3.pdf?index=true
- https://76d4dde4-007f-448a-a6f9-b9189b514b14.filesusr.com/ugd/eda9ba_38a9efbdc1474123bf443d89f9266fe7.pdf?index=true
- https://e51b3815-e0e9-4a84-b795-529b34c0fcea.filesusr.com/ugd/ea2f88_72a981e3d1fe45ea880727bb756a7b03.pdf?index=true
- https://581a3f06-110f-4161-900a-adb2f1582a78.filesusr.com/ugd/92ee2b_24b3acd31dac4ef990537552145c3959.pdf?index=true
- https://cdn.shopify.com/s/files/1/0434/1946/7932/files/zujutesilaxesiwokob.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kividerinogofigizunewif.pdf
- https://cdn.shopify.com/s/files/1/0432/4173/4307/files/kill_myself_game.pdf
- https://cdn.shopify.com/s/files/1/0437/5432/4117/files/bolton_wanderers_current_form.pdf
- https://cdn.shopify.com/s/files/1/0431/6967/7474/files/bilabarivenak.pdf
- https://cdn.shopify.com/s/files/1/0434/1497/8718/files/algoritmo_informatica_definicion.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0484/3972/2138/fil

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000086e5.bin` `fca915958b757839df42a55429b94d98cdd593870854c3e1c2f89a5c841e9609`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x86E5	5220 bytes
`font_01_sfnt_off000098c3.bin` `72c92379449ec975b69da8cbb34bd381bbb6d44fbcc780177483ae02f43727f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x98C3	11576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.