PDF malware analysis — malicious · b138147a02b03ffa

MALICIOUS

PDF

56.8 KB Created: 2020-09-01 15:21:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fa9cb14c5f1b9b1f51289dda706c4efa SHA-1: f54d16a7c3613f7187415e38f727847b8fa1ee90 SHA-256: b138147a02b03ffabf6a6738b6911f7edf3f8cad332f2cdd4f7f62e3f680f98d

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF file contains a link to a malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to 'frontier communications report outage' and urgency lures, suggesting a phishing attempt. The PDF also hosts a link farm, as indicated by the PDF_SEO_LINK_FARM heuristic, which points to various benign-looking PDFs but likely serves to obscure the malicious redirector. The primary malicious IOC is the redirector URL.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=frontier+communications+report+outage
- https://static.usrfiles.com/ugd/b8c837_76caa8574d1f42748c249e5a7a8c8f39.pdf
- https://static.usrfiles.com/ugd/99965f_30875065b23f4d99aa46b61bb4fd7f27.pdf
- https://static.usrfiles.com/ugd/b8c837_c65af926c56240ddb3ca1dde6b75fe90.pdf
- https://static.usrfiles.com/ugd/868401_5deae305322b45ddbc483d0e9dec6325.pdf
- https://static.usrfiles.com/ugd/529dbf_c347f627c3424608a77c8c5690d898f6.pdf
- https://static.usrfiles.com/ugd/0c268c_ca8d8acd19014e19a7b154148e556772.pdf
- https://cdn.shopify.com/s/files/1/0433/0464/8859/files/vimeduzagaxowusudodowol.pdf
- https://cdn.shopify.com/s/files/1/0437/4865/5265/files/performance_appraisal_template_sample.pdf
- https://cdn.shopify.com/s/files/1/0433/9400/7201/files/viva_pinata_variants.pdf
- https://cdn.shopify.com/s/files/1/0434/6898/0377/files/80807466299.pdf
- https://static.usrfiles.com/ugd/b8c837_746157b471144a1fb978a10598d5059e.pdf
- https://static.usrfiles.com/ugd/e3ed1f_3e7ba95ce1ab4196aba92cbb0fe3ea65.pdf
- https://static.usrfiles.com/ugd/b8c837_9d97030adb904e1da4e1960c69db5cda.pdf
- https://static.usrfiles.com/ugd/9edd50_d0ecd74d3b024cf29f3bd6c8f75efbdc.pdf
- https://static.usrfiles.com/ugd/b8c837_1e95fec18a414b6698e1d9e79c1d23d1.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000a17d.bin` `3ae9b9046f385da24c3f2431d70b975eb37b5a495b54836cc33151b080eec6dc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA17D	5176 bytes
`font_01_sfnt_off0000b304.bin` `b2e39e7fdf963803aa640590d79c838b10618e9ab44f28f30cd40e9a17d03e7d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB304	10272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.