PDF malware analysis — malicious · b5ffaf81a74f47bd

MALICIOUS

PDF

40.7 KB Created: 2020-08-30 02:16:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 55133eea0067c5e17892329227aba122 SHA-1: 633825e650f88e0eea77f66bd0d944fb86ad2062 SHA-256: b5ffaf81a74f47bdc2e6969bae07414fe64b0fb3cafef769230682ccda7795b7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for a 'recipe book'. The presence of a mass external PDF link farm further suggests a malicious intent to distribute content or redirect users to harmful sites. The primary IOC is the malicious redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=kayla+itsines+recipe+book
- https://static.usrfiles.com/ugd/a48928_f6922f73750b41e19e7ea232db5f61d6.pdf
- https://static.usrfiles.com/ugd/269bb8_17739e36758445c9bf756400c380699f.pdf
- https://static.usrfiles.com/ugd/b8c837_e83e55ae049b44ef9bea7ddb6f6da725.pdf
- https://static.usrfiles.com/ugd/c1de29_c2bf9ad5d921441c99709c5a14d57719.pdf
- https://static.usrfiles.com/ugd/b8c837_e457ef8d9ca54f368d538eec07eb97c9.pdf
- https://static.usrfiles.com/ugd/dd4472_91dcc7da558f4cfaa5525f4c66c15f74.pdf
- https://static.usrfiles.com/ugd/a4d998_f7a4dfacc38a48f1b6ad7c91ad5c8be4.pdf
- https://static.usrfiles.com/ugd/c162b3_23f382da7b8e464d8b36afdd65a1d0c1.pdf
- https://cdn.shopify.com/s/files/1/0431/2121/3591/files/xixifojuxuzumufifenok.pdf
- https://cdn.shopify.com/s/files/1/0431/1928/0288/files/71838436910.pdf
- https://cdn.shopify.com/s/files/1/0438/0668/7389/files/33260361203.pdf
- https://cdn.shopify.com/s/files/1/0435/6099/2927/files/pofuxodedekedawamikip.pdf
- https://cdn.shopify.com/s/files/1/0433/5802/7928/files/26037665464.pdf
- https://static.usrfiles.com/ugd/73c254_c71ef5e0105d43cdb08aa1f232f5a896.pdf
- https://static.usrfiles.com/ugd/de02f3_a938bedb2eae4d43a7800d62f761b933.pdf
- https://static.usrfiles.com/ugd/704566_fd8be3da22a24f3aa554a94a4e8d948b.pdf
- https://static.usrfiles.com/ugd/b8c837_2e25ee465b3d428b8809d408e3070812.pdf
- https://static.usrfiles.com/ugd/4ae4db_4dd86b7a20364a53a82eced13e00dfbb.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000061d7.bin` `291a080bfe2cfa2a5b46aee49c9f0c72529694d2a73385353fa1396abe25f92a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61D7	5200 bytes
`font_01_sfnt_off00007391.bin` `32bae567d64bd6f619f31ddb7e65a03f45939b5955242eaab252d31230f8f1c8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7391	10044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.