PDF malware analysis — malicious · a1900d8eee9780b2

MALICIOUS

PDF

43.1 KB Created: 2020-08-03 10:43:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4c18dcf52e123c9f019eeea46d0e6572 SHA-1: 398803e2feacf0c6afd5d4f70863f62e13babcbc SHA-256: a1900d8eee9780b285f4f03a91695a703758292163132e4c5dfec03ee13f4a3b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to `https://ttraff.cc/pify?keyword=rcbs+reloading+manual+pdf`. This URL is presented within the document body, disguised as a reloading manual. The PDF also exhibits characteristics of a link farm, with numerous external links, many pointing to Shopify domains, but the primary malicious intent appears to be the redirector. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=rcbs+reloading+manual+pdf
- http://files.stainedglasswow.com/uploads/1/3/1/4/131437977/32ad3fb2e.pdf
- http://files.muppetschildrenscentres.com/uploads/1/3/0/9/130969026/bimukotawonopaxumavu.pdf
- http://files.learningforcharity.ca/uploads/1/3/2/6/132695432/8496480.pdf
- https://cdn.shopify.com/s/files/1/0429/2745/6419/files/physics_laboratory_experiments_7th_edition.pdf
- https://cdn.shopify.com/s/files/1/0431/0892/5600/files/76732021691.pdf
- https://cdn.shopify.com/s/files/1/0431/7052/9436/files/76475800316.pdf
- https://cdn.shopify.com/s/files/1/0436/4717/2768/files/5604924762.pdf
- https://cdn.shopify.com/s/files/1/0434/3349/2641/files/gosololixume.pdf
- https://cdn.shopify.com/s/files/1/0433/4836/1375/files/43904097766.pdf
- https://cdn.shopify.com/s/files/1/0427/8494/8380/files/nikesezaxetutavebubo.pdf
- https://cdn.shopify.com/s/files/1/0434/6891/4838/files/31046347102.pdf
- https://cdn.shopify.com/s/files/1/0436/3078/8758/files/96604766882.pdf
- https://cdn.shopify.com/s/files/1/0430/0092/2265/files/93754814447.pdf
- https://cdn.shopify.com/s/files/1/0431/8612/7009/files/81502554804.pdf
- https://cdn.shopify.com/s/files/1/0434/5249/8070/files/jilumago.pdf
- https://cdn.shopify.com/s/files/1/0434/8451/2418/files/github_ssh_permission_denied_publickey.pdf
- https://cdn.shopify.com/s/files/1/0437/7378/8321/files/lejakanukuzafaziliran.pdf
- https://cdn.shopify.com/s/files/1/0431/8347/2802/files/18753600758.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006984.bin` `f5457eb3a0ab0d7c11998450575829f3e45e81ee8ca3f6b78efd74afd961c3c7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6984	5620 bytes
`font_01_sfnt_off00007c8b.bin` `64b4e86439498f5ed55c68a7324401cc7538528ee9dc869a9d974665ef6e793c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C8B	10320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.