PDF malware analysis — malicious · b91392341db93523

MALICIOUS

PDF

55.1 KB Created: 2020-09-16 16:23:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9a585b4bbaf3749c9cdb66c2af5394ad SHA-1: a21d40519e471200a7a366ef97764bbb6006574b SHA-256: b91392341db93523d4c350a287de1cc70c51fc05edf554fac388612cd98ec1ff

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, a technique often used to obscure malicious destinations and improve search engine rankings for malicious content. One of the primary links directs to a known malicious redirector, which likely leads to further malicious content. The document body, though heavily obfuscated, contains text related to 'worksheet answers' and includes the malicious URL, suggesting a lure to trick users into clicking the link.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=cpctc+worksheet+answers+kuta+software
- http://regil.heidispiritmedium.com/uploads/1/3/0/7/130739415/173174.pdf
- http://jizunaro.laurawritingcoach.com/uploads/1/3/1/3/131381806/temotesoruba.pdf
- https://ae5f4f0c-dc59-4df0-ba50-facd1f4c339e.filesusr.com/ugd/3283b0_4991e5a4a6e946d19090865f83126c67.pdf?index=true
- https://d013910e-b479-4e70-8c1c-9c11c4f65daa.filesusr.com/ugd/145364_de1843baaf2447e8b2940461c4df2c1d.pdf?index=true
- https://e1751e7f-a46a-4e9a-8295-ea902bd7e176.filesusr.com/ugd/29c71c_67442ed6582345d4992544c6323759a2.pdf?index=true
- https://427721dd-fb14-4df7-bc91-b7f222aa2186.filesusr.com/ugd/35c6e2_ac7f321c5fc24a0089aaa82726fbfbf2.pdf?index=true
- https://f5a73eef-2334-4481-82cf-febfc91f6ae0.filesusr.com/ugd/277b62_d1f4dbb697f445f59fe2bc405d8b3409.pdf?index=true
- https://cdn.shopify.com/s/files/1/0431/3448/4648/files/vixaniluzovixibagevewubex.pdf
- https://cdn.shopify.com/s/files/1/0432/4163/5997/files/niwoniruwodufofitetu.pdf
- https://cdn.shopify.com/s/files/1/0430/8949/4177/files/dell_sk_8115.pdf
- https://cdn.shopify.com/s/files/1/0433/4885/2904/files/lawabajozixavov.pdf
- https://cdn.shopify.com/s/files/1/0434/1510/9797/files/81749179194.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007c53.bin` `90f2dd1fd611643760a24b9d1a99b6eddfc28c4eb8dff69c37ce87fc0624dbfa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C53	5132 bytes
`font_01_sfnt_off00008dd6.bin` `410d16ff839e76307c769ef6207b9f750d160062d2d8668c75a2d2748c0c0515`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DD6	13676 bytes
`font_02_sfnt_off0000b9ff.bin` `13596defb2bcc6fc1048af8e1a4b019015f57a35384aba88f9e1637b8f94b635`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB9FF	16168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.