PDF malware analysis — malicious · c0946492dbeb4919

MALICIOUS

PDF

41.9 KB Created: 2020-08-25 08:38:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3ce9ff64c22580867f1033d4a7cbdef6 SHA-1: 8f13824cfc78cc89b1a2e1e09bbc8ea732721cd8 SHA-256: c0946492dbeb4919b830d2247786dd1b9c2df3bad2d2f976785e830e7261e712

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to a malicious URL, disguised as an answer key for a critical thinking test. The document also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF files, likely for SEO manipulation or to host further malicious content. The primary malicious URL identified is https://ttraff.ru/pify?keyword=cornell+critical+thinking+test+level+x+answers.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=cornell+critical+thinking+test+level+x+answers
- http://gitera.smartfurniture.matchpages.com/uploads/1/3/1/6/131637896/jijano.pdf
- http://files.135miles.org/uploads/1/3/1/0/131070559/92a1d3d45c77a59.pdf
- http://mokeju.eartharkbotswana.com/uploads/1/3/1/4/131483245/5513673.pdf
- http://files.habitatstudioatx.com/uploads/1/3/0/7/130740461/0f31b7410237bf.pdf
- http://fanimokad.tyrarexin.com/uploads/1/3/1/8/131857419/bikenudaliguza-mosuletibanetid-xapoxodulewu-xibusij.pdf
- https://cdn.shopify.com/s/files/1/0430/1121/1425/files/zalubizazewegapumuwela.pdf
- https://cdn.shopify.com/s/files/1/0430/8071/2343/files/mijixalo.pdf
- https://cdn.shopify.com/s/files/1/0435/8435/6507/files/75022787746.pdf
- https://cdn.shopify.com/s/files/1/0430/5282/6777/files/18769677942.pdf
- https://cdn.shopify.com/s/files/1/0436/9979/8166/files/math_grade_7_book.pdf
- https://cdn.shopify.com/s/files/1/0432/2518/6466/files/visiting_card_format_photoshop.pdf
- https://cdn.shopify.com/s/files/1/0432/2571/0750/files/48932216138.pdf
- https://cdn.shopify.com/s/files/1/0434/2025/4375/files/61920448725.pdf
- https://cdn.shopify.com/s/files/1/0440/7253/4166/files/technological_innovation_in_legacy_sectors.pdf
- https://cdn.shopify.com/s/files/1/0428/3518/1724/files/79110843609.pdf
- https://cdn.shopify.com/s/files/1/0448/2249/5389/files/ramayana_story.pdf
- https://cdn.shopify.com/s/files/1/0437/1664/0919/files/medical_bills_on_credit_report_2019.pdf
- https://cdn.shopify.com/s/files/1/0431/8098/2429/files/rakele.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000654f.bin` `1b4b1e37f2adbc98ccd2f98caa23cf10b8696dbb4d5bc0cf274a149336a4f796`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x654F	5252 bytes
`font_01_sfnt_off00007735.bin` `23d68f09aa00c2d02fdc5f1b29a32367d107d3e0413c80c2a082e253f76e7280`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7735	10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.