PDF malware analysis — malicious · c0239c48692ac70f

MALICIOUS

PDF

53.9 KB Created: 2020-08-30 09:47:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 738a7ed02757bb16a897e538e7b5a0cb SHA-1: 6aa50a4c7e113705a5c6e74180ff2cacb0e61d4a SHA-256: c0239c48692ac70feb722d1483078bf36a849f6f57322416642a19262a18c1db

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with a critical heuristic firing for a PDF link farm. One of the primary links points to a known malicious redirector. The document body contains garbled text and a URL that appears to be part of the link farm, suggesting a deceptive or spamming purpose.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=iron%2528+iii+chloride%2528+aq+cesium+phosph
- https://cdn.shopify.com/s/files/1/0433/3325/5323/files/72521297194.pdf
- https://cdn.shopify.com/s/files/1/0430/9437/6599/files/jojalaruvejisozape.pdf
- https://cdn.shopify.com/s/files/1/0432/5700/4192/files/podremos_vivir_juntos_alain_touraine_libro.pdf
- https://cdn.shopify.com/s/files/1/0430/9748/9572/files/fevavawabudojerijeruxenow.pdf
- https://cdn.shopify.com/s/files/1/0432/8947/7278/files/moboselibotosolite.pdf
- https://cdn.shopify.com/s/files/1/0431/1410/2950/files/badinerie_tuba_solo.pdf
- https://cdn.shopify.com/s/files/1/0431/5702/9019/files/rapefaporomaxumepaw.pdf
- https://cdn.shopify.com/s/files/1/0428/5323/6902/files/wevusenilumogegero.pdf
- https://static.usrfiles.com/ugd/b8c837_b33179107214499daf91052a7bd513ee.pdf
- https://static.usrfiles.com/ugd/225520_a0db34e4fdac42e6a4830497d29ac162.pdf
- https://static.usrfiles.com/ugd/23e9be_08358360c2364004b36ca4456fa57b7c.pdf
- https://cdn.shopify.com/s/files/1/0431/8222/7617/files/beps_action_3.pdf
- https://cdn.shopify.com/s/files/1/0429/2096/8358/files/abortus_imminens_2020.pdf
- https://cdn.shopify.com/s/files/1/0429/2821/0086/files/european_society_cardiology_guidelines_atrial_fibrillation.pdf
- https://cdn.shopify.com/s/files/1/0432/6067/4198/files/rijuvolaxepexewegok.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006249.bin` `c3257ba456076b702672cddb6b81e9b60ad3f07188eaf69e617f437af633154a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6249	5256 bytes
`font_01_sfnt_off000073eb.bin` `bf70a4f7a874478da429a3356bd23be3b76b8d78f931199f17c22afd430d0c7f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x73EB	16472 bytes
`font_02_sfnt_off0000a702.bin` `e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA702	16204 bytes
`font_03_sfnt_off0000bc30.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC30	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.