PDF malware analysis — malicious · a071ea3165c61066

MALICIOUS

PDF

43.0 KB Created: 2020-08-31 15:19:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 98d4f8c65d4fa52300ef65371954579b SHA-1: 4aa9e739c3def00b298eb4af617bcf8395154688 SHA-256: a071ea3165c61066cb2750a10a9a020aaaa020b52c003d96af3bef63971d4d11

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The PDF file contains a lure related to a 'CE self certification form example' and embeds a link that redirects to known malicious infrastructure. Additionally, it presents a social engineering tactic by instructing the user to install a browser extension or update, a common method for malware delivery or credential theft. The presence of numerous external PDF links, many hosted on Shopify, suggests a link farm for SEO manipulation or to obscure the ultimate destination.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=ce+self+certification+form+example
- https://cdn.shopify.com/s/files/1/0471/0671/9894/files/9107544180.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/5866669006.pdf
- https://cdn.shopify.com/s/files/1/0434/5865/8469/files/zipgrade_answer_sheet.pdf
- https://cdn.shopify.com/s/files/1/0437/6811/9445/files/gufelenudulegokosafexok.pdf
- https://cdn.shopify.com/s/files/1/0440/6712/7446/files/womomijutujo.pdf
- https://cdn.shopify.com/s/files/1/0436/0460/7139/files/menowisixizikumuzexo.pdf
- https://cdn.shopify.com/s/files/1/0435/1324/9944/files/51022580141.pdf
- https://cdn.shopify.com/s/files/1/0440/7797/3654/files/53206305102.pdf
- https://static.usrfiles.com/ugd/b85eb0_ecb1912110364f3a9ba6ff3bf8bf9578.pdf
- https://static.usrfiles.com/ugd/0cd019_a9c9f9a019c24755a5e03b65d56c95af.pdf
- https://static.usrfiles.com/ugd/12dc78_185c245d1cc44d94b508c494ba55aabf.pdf
- https://static.usrfiles.com/ugd/07625c_a5d46c812197449bac912aa337477e8e.pdf
- https://static.usrfiles.com/ugd/b8c837_ed579ad385854d5c88d434ac03084648.pdf
- https://static.usrfiles.com/ugd/fe83c3_d473836de4f2413c8339f33c79a6b698.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006b2f.bin` `09789f350d59a7575fabbda935a96f02a97e00bbb0f3d0d5d0410f3d19880366`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B2F	5136 bytes
`font_01_sfnt_off00007c94.bin` `da22a215be4eb2786613dc8b7b2a09305126b5400f8dbc3b9529eeb97948ed05`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C94	10116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.