PDF malware analysis — malicious · af31d397709a9535

MALICIOUS

PDF

61.9 KB Created: 2020-07-20 11:21:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6b73a52f38f5f0f79f27468390f1f874 SHA-1: 3d405572f8f850a866910e0db3e3f263f8090b2c SHA-256: af31d397709a9535a1eb912bad52f136179492efca758e5464b9961b2700406b

160 Risk Score

Malware Insights

MITRE ATT&CK

T1200 Hardware Add-in T1059 Command and Scripting Interpreter T1566 Phishing

The PDF contains multiple embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, appears to contain keywords related to 'cydia apk iphone 5', suggesting a lure for potentially malicious software. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' indicates the document may also instruct the user to execute commands, further increasing the risk.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=cydia+apk+iphone+5
- http://files.robinsonauctionservice.com/uploads/1/3/1/0/131070216/1e469d167d3a47d.pdf
- http://files.gobigt.com/uploads/1/3/0/7/130775978/cddb4.pdf
- http://files.darkhorsespirit.com/uploads/1/3/0/9/130968961/6f0af.pdf
- http://files.dancestudiesuoft.ca/uploads/1/3/0/7/130775102/vozidowoviketuwa.pdf
- https://cdn.shopify.com/s/files/1/0427/7728/0671/files/52733817477.pdf
- https://cdn.shopify.com/s/files/1/0430/6580/2903/files/91861273731.pdf
- https://cdn.shopify.com/s/files/1/0433/3692/5342/files/52681330903.pdf
- https://cdn.shopify.com/s/files/1/0434/1674/8190/files/livodomomutepegewaxur.pdf
- https://zodizijemas.files.wordpress.com/2020/07/66665986191.pdf
- https://fofawogo.files.wordpress.com/2020/07/nidabib.pdf
- https://nivosere.files.wordpress.com/2020/07/44741790827.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/8011835234.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/42778697636.pdf
- https://cdn.shopify.com/s/files/1/0432/0926/1218/files/midobub.pdf
- https://cdn.shopify.com/s/files/1/0431/5214/6587/files/19345844843.pdf
- https://cdn.shopify.com/s/files/1/0432/8646/2620/files/97139899393.pdf
- https://cdn.shopify.com/s/files/1/0429/1035/1513/files/kazuvodakitolo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b71f.bin` `b909eb878a644b4cae117d4904106c8a9059ade84a4679d34dc6bdfb467a5ba2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB71F	4764 bytes
`font_01_sfnt_off0000c74f.bin` `9dc5c4b7cdaf251f304f3649c513a7fc771419101da0fb56e66dcc01482fdbe6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC74F	10280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.