PDF malware analysis — malicious · c06dca7c4ec89316

MALICIOUS

PDF

46.4 KB Created: 2020-07-26 11:48:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3a95b30b508845a2be497ad03ec8febc SHA-1: 605ae5c9059bbd31fbe211a9446d758312e557c2 SHA-256: c06dca7c4ec893161ad0ce26e8953117b6e45abb253354d4da2320c8a7e6b16b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a link farm. One of the primary links, 'https://ttraff.cc/pify?keyword=context+clues+worksheets+online', leads to known malicious redirector infrastructure. The document body appears to be heavily obfuscated or corrupted, preventing a clear understanding of its intended lure, but the presence of the link farm and malicious redirector strongly suggests a phishing or social engineering attack.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=context+clues+worksheets+online
- http://files.sophiabaptistchurch.com/uploads/1/3/1/3/131381006/babazemobozike-ponavesa-jivuranemoroj.pdf
- http://files.heartofillinoisorff.org/uploads/1/3/1/3/131379371/9586210.pdf
- http://files.nickseifert.com/uploads/1/3/2/6/132680852/lirurifijewure-vedimopiz.pdf
- http://files.emeraldroomhall.com/uploads/1/3/2/6/132695698/4014ff905b008.pdf
- http://files.emeraldroomhall.com/uplo
- https://cdn.shopify.com/s/files/1/0434/5479/1846/files/45290060818.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/1204107997.pdf
- https://cdn.shopify.com/s/files/1/0437/3698/9850/files/20242114480.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/44411244229.pdf
- https://cdn.shopify.com/s/files/1/0434/3853/8904/files/rubifexizasolidezekumali.pdf
- https://cdn.shopify.com/s/files/1/0428/1293/2255/files/xaporogodox.pdf
- https://cdn.shopify.com/s/files/1/0428/2135/3635/files/visawirozepimufoke.pdf
- https://cdn.shopify.com/s/files/1/0435/6866/0643/files/38958588362.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/63912397784.pdf
- https://cdn.shopify.com/s/files/1/0428/7594/5113/files/tigudutemururekudurofevob.pdf
- https://cdn.shopify.com/s/files/1/0438/6747/2037/files/91671558787.pdf
- https://cdn.shopify.com/s/files/1/0432/5651/2667/files/27771797776.pdf
- https://cdn.shopify.com/s/files/1/0439/1780/3675/files/5585391681.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000079d7.bin` `a63a2b63f90bb4518737bde59cecff46c3ea2816159c4985dbe844354bf58771`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79D7	4804 bytes
`font_01_sfnt_off00008a3e.bin` `d09667ac6b5f657a25c42c7743ff004ecb7cefeba1c4fd8d0f07b63d3a8fd5a4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A3E	10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.