PDF malware analysis — malicious · b63a0636a2b56466

MALICIOUS

PDF

46.4 KB Created: 2020-08-30 11:00:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 71f5bf969c462be871a5e3c082351223 SHA-1: c249bdc6af85357449bb1ec143b9a67e9bebad7d SHA-256: b63a0636a2b56466cecd06512e30fda4be6caa8718b3e10a080a9f9a23dfbb7f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a large number of embedded links, a technique often used for SEO poisoning or to redirect users to malicious sites. The primary redirector URL, https://ttraff.com/wix?keyword=ph+y+actividad+enzimatica+amilasa+sa, is flagged as malicious. While the document body contains garbled text, the presence of numerous links and the malicious redirector strongly suggest a phishing or malware delivery attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=ph+y+actividad+enzimatica+amilasa+sa
- https://cdn.shopify.com/s/files/1/0434/2166/3397/files/sofivibinijedaxanotije.pdf
- https://cdn.shopify.com/s/files/1/0436/9963/4328/files/piwojisujitudaxogon.pdf
- https://cdn.shopify.com/s/files/1/0437/5265/2951/files/numeros_cuanticos_del_magnesio.pdf
- https://static.usrfiles.com/ugd/e3325f_36119592474049d6aedb0ec568536baa.pdf
- https://static.usrfiles.com/ugd/ddb60a_f3b41d6854734770b552a9340244055c.pdf
- https://static.usrfiles.com/ugd/b8c837_23aa52622ae04cd6862ec580406df94f.pdf
- https://static.usrfiles.com/ugd/b8c837_b0e989ece0c043408877d2cb320f75f9.pdf
- https://static.usrfiles.com/ugd/4725f1_793ad93049ce4570bc839e570f39ae9e.pdf
- https://static.usrfiles.com/ugd/b8c837_a0d0e11fb6cf43d29792f026b4d63c22.pdf
- https://static.usrfiles.com/ugd/b7ed05_0f984946d7cf428bbfaded75a255652d.pdf
- https://static.usrfiles.com/ugd/b8c837_ae6b6a3abb8f4e8797b7cd5b917673a0.pdf
- https://static.usrfiles.com/ugd/b8c837_039835a708814282a1dc5d2e04d0ec66.pdf
- https://static.usrfiles.com/ugd/b8c837_2f045f1f5c8348eeb9a5d24a90b7582d.pdf
- https://static.usrfiles.com/ugd/b8c837_b46e33b7615440d2a3be22edfa922d3e.pdf
- https://static.usrfiles.com/ugd/b8c837_4887ac9c92e94fc5863722ec49a8ce1b.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/ddb60a_f3b41d6854734770b552a9340244055

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007331.bin` `363c55f51dfa49f3d0ae1dfb786ac751e78db5dd437eacfddafc4b3014870a4e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7331	5296 bytes
`font_01_sfnt_off00008517.bin` `c70697584a9deb4245cef0edcfc4de04321d808c9b4b05fbf1abd1bae1357594`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8517	11544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.