PDF malware analysis — malicious · ba1443c93989354c

MALICIOUS

PDF

47.8 KB Created: 2020-07-29 07:07:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6c37c0f21f01e46b5d39a372da7508ee SHA-1: b82c8aa11973a48cec4d3a036a32ba3e247824f4 SHA-256: ba1443c93989354c6cee4a8ba313be8cb056a86a3aa53e0e598b0b7fe3135a6a

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to Shopify domains hosting other PDF files, suggesting a link farm for SEO manipulation. One critical heuristic identified a link to a known malicious redirector at 'https://ttraff.ru/pify?keyword=kanban+board+template+word'. The document body, though heavily obfuscated, contains keywords related to templates and the authoring application, reinforcing the lure. The presence of numerous links and the redirection to a malicious site indicate a phishing or scam attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=kanban+board+template+word
- http://files.lotusawakeningbodywork.com/uploads/1/3/1/3/131384721/89b487b80.pdf
- http://files.gogirlempowerment.org/uploads/1/3/1/3/131384359/tizizozewaxol.pdf
- http://files.verduemedia.com/uploads/1/3/1/8/131871859/fujigagudutujotez.pdf
- https://cdn.shopify.com/s/files/1/0435/0276/4184/files/pufanosatudajoxijij.pdf
- https://cdn.shopify.com/s/files/1/0440/1650/0886/files/siketetevigefidisenogiri.pdf
- https://cdn.shopify.com/s/files/1/0433/7205/2643/files/58656306706.pdf
- https://cdn.shopify.com/s/files/1/0434/7386/2821/files/93087323286.pdf
- https://cdn.shopify.com/s/files/1/0429/3846/6467/files/45699555739.pdf
- https://cdn.shopify.com/s/files/1/0433/9544/8997/files/18130354163.pdf
- https://cdn.shopify.com/s/files/1/0430/5308/8919/files/71863029772.pdf
- https://cdn.shopify.com/s/files/1/0432/1522/4996/files/zetesefakowawuparotevuv.pdf
- https://cdn.shopify.com/s/files/1/0431/2625/9876/files/mememuduk.pdf
- https://cdn.shopify.com/s/files/1/0429/4295/5676/files/gugutubebivuwelinuri.pdf
- https://cdn.shopify.com/s/files/1/0436/9262/1978/files/10365986392.pdf
- https://cdn.shopify.com/s/files/1/0430/5348/2135/files/wupudax.pdf
- https://cdn.shopify.com/s/files/1/0427/8996/1884/files/35055990488.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007ecd.bin` `8b7506d562ad7bf690cd890c2f539bc0d90504a35dae0f075cfb624084d5f152`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7ECD	4868 bytes
`font_01_sfnt_off00008f44.bin` `30ea726e220398bf5ec369478079e349b18a19d47625d09ad7a8329efe9e2f17`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F44	10180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.