PDF malware analysis — malicious · b0e5d18a2553e1c7

MALICIOUS

PDF

56.0 KB Created: 2020-08-09 05:58:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 55a4aae366387cffea50b09ea7de4f0b SHA-1: 36683a41dcdf85993a47335e8b991c1afc4739a4 SHA-256: b0e5d18a2553e1c7195f490bdf3a9dccdc5039e1fb2ae593e9d31e5d63799109

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with a critical heuristic identifying a link to a known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to 'aptransco ae syllabus pdf' and the malicious URL. This suggests the document's primary purpose is to redirect users to malicious content, likely for phishing or malware distribution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=aptransco+ae+syllabus+pdf
- http://files.taikkun.com/uploads/1/3/1/0/131070733/rojafozorabufujop.pdf
- http://files.kilsythcommunitychurch.com/uploads/1/3/1/4/131438464/13be6f9f1a3bd9.pdf
- http://gifafev.kellytuckercreates.com/uploads/1/3/2/8/132814930/3852318.pdf
- https://cdn.shopify.com/s/files/1/0433/4462/5813/files/niv_essentials_study_bible.pdf
- https://cdn.shopify.com/s/files/1/0429/3410/8323/files/6369508089.pdf
- https://cdn.shopify.com/s/files/1/0432/6539/2804/files/nobunigagirazuzoker.pdf
- https://cdn.shopify.com/s/files/1/0433/1126/7990/files/xewikefisimob.pdf
- https://cdn.shopify.com/s/files/1/0434/9113/1554/files/funobomerariboruxewizokas.pdf
- https://cdn.shopify.com/s/files/1/0430/8706/9335/files/89118479664.pdf
- https://cdn.shopify.com/s/files/1/0431/3061/8020/files/village_business_ideas_in_tamil.pdf
- https://cdn.shopify.com/s/files/1/0435/2458/7674/files/62671635842.pdf
- https://cdn.shopify.com/s/files/1/0427/4018/7303/files/deroxewilaberele.pdf
- https://cdn.shopify.com/s/files/1/0429/5108/2143/files/28329391293.pdf
- https://cdn.shopify.com/s/files/1/0435/5378/3957/files/42319808311.pdf
- https://cdn.shopify.com/s/files/1/0436/3137/8590/files/84228374916.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000071ea.bin` `a62e7494fa027c931bb10ce2b8bf1387ad5f40fa8862db7df88251536bc4b207`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71EA	5380 bytes
`font_01_sfnt_off00008443.bin` `1beccf181cdabf531a881538c17b1ecf0c14c289dc403e954d4fcbe57dc728bf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8443	6760 bytes
`font_02_sfnt_off000099e5.bin` `b55bc09f38d38b209fa09cc5a1a9fbff6c77cccdf5665a870a9f0dbc116a67be`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x99E5	10448 bytes
`font_03_sfnt_off0000bdb2.bin` `e9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBDB2	16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.