PDF malware analysis — malicious · a0c92c5cb8aa080b

MALICIOUS

PDF

44.5 KB Created: 2020-07-25 01:32:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8abb3633e54a9a2b698ffc410fadc95a SHA-1: 2a21e147122313cec1a6172e12af0faf7043b362 SHA-256: a0c92c5cb8aa080be6dcd1355292327599d0d54c693713972252de549ae9b423

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a link farm hosted on cdn.shopify.com, and one critical link to a known malicious redirector at ttraff.com. The document body, though heavily obfuscated, suggests a lure related to a 'Beginner's guide to tarot pdf'. The heuristics indicate the PDF is designed to redirect users to malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wb?keyword=beginner
- http://files.midwestjuniorpreviewshow.com/uploads/1/3/0/8/130874307/desuvevatebakogelu.pdf
- http://files.morroandjasp.com/uploads/1/3/2/6/132682820/af136ff42878.pdf
- http://files.citycentrechurch.ca/uploads/1/3/1/0/131070112/d2032d.pdf
- http://files.localalarm.net/uploads/1/3/0/8/130813777/reniwube.pdf
- http://files.schulzeteach.com/uploads/1/3/1/0/131070192/38e297e75f8650.pdf
- http://files.citycentrechurch.ca/uploads/1/3
- https://cdn.shopify.com/s/files/1/0432/8649/5397/files/noketimumusazoz.pdf
- https://cdn.shopify.com/s/files/1/0430/4217/7181/files/manabelafidokavuruweno.pdf
- https://cdn.shopify.com/s/files/1/0430/8067/9577/files/18804936320.pdf
- https://cdn.shopify.com/s/files/1/0436/1384/7710/files/wimalarebesokose.pdf
- https://cdn.shopify.com/s/files/1/0437/8545/3730/files/46160092085.pdf
- https://cdn.shopify.com/s/files/1/0431/0089/7440/files/35609941257.pdf
- https://cdn.shopify.com/s/files/1/0430/4705/9607/files/rezoxigekafuwujig.pdf
- https://cdn.shopify.com/s/files/1/0438/5295/5810/files/45043094790.pdf
- https://cdn.shopify.com/s/files/1/0433/4521/5656/files/mamomuzasinoguvijanuzavod.pdf
- https://cdn.shopify.com/s/files/1/0427/9199/3500/files/28673597238.pdf
- https://cdn.shopify.com/s/files/1/0432/9740/7126/files/jozitusabewibo.pdf
- https://cdn.shopify.com/s/files/1/0433/1657/6424/files/dufedizasopejukufegat.pdf
- https://cdn.shopify.com/s/files/1/0428/8679/1334/files/31695655804.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000071dc.bin` `ec26158120327811badb833f8b4868f7665328ee4a4a4f77628d769f200f9eb4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71DC	5140 bytes
`font_01_sfnt_off00008369.bin` `22380117d956cf0fd1922aafd1bc4f9e08bbb87e7ee76c282b468c0b761b55e5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8369	9768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.