PDF malware analysis — malicious · c21d077c6f04e178

MALICIOUS

PDF

38.8 KB Created: 2020-08-20 05:45:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5df5b64d2130793a65ab5ca818f9bdc1 SHA-1: 00c003db308071e517589767e57a1883dc05f277 SHA-256: c21d077c6f04e178de520f4a4927b792fa1bb25dcd3cab07749617630658d7f1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of embedded links, identified as a link farm, designed to redirect users to malicious infrastructure. The primary malicious URL identified is https://ttraff.ru/pify?keyword=o+balma+odia+song+ringtone. The document body itself is heavily obfuscated but contains references to this URL and other Shopify-hosted PDFs, suggesting a lure to download further content or be redirected to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=o+balma+odia+song+ringtone
- http://files.gemscene.com/uploads/1/3/2/7/132712333/5866538.pdf
- http://files.wivco.com/uploads/1/3/0/7/130738597/vosujufesa-nodaneg.pdf
- http://sexomu.coachingbytheballs.com/uploads/1/3/0/7/130738950/renabumewevif.pdf
- http://jorosef.anti-agingbyrjxjelly.com/uploads/1/3/2/3/132303354/8686563.pdf
- http://gekuk.southerncommunitystudy.org/uploads/1/3/0/7/130739206/xatebesopa-mokosipireje-pilemom-junerosenof.pdf
- https://cdn.shopify.com/s/files/1/0431/6590/9160/files/understanding_comics_chapter_4.pdf
- https://cdn.shopify.com/s/files/1/0437/5996/0218/files/opera_sports_news_report.pdf
- https://cdn.shopify.com/s/files/1/0433/8306/2678/files/free_download_islamic_books_urdu_language.pdf
- https://cdn.shopify.com/s/files/1/0435/7108/5475/files/html_to_angular.pdf
- https://cdn.shopify.com/s/files/1/0433/3345/1944/files/56222408410.pdf
- https://cdn.shopify.com/s/files/1/0439/3179/5624/files/36432276277.pdf
- https://cdn.shopify.com/s/files/1/0427/6987/5111/files/xukelipalafurusutaji.pdf
- https://cdn.shopify.com/s/files/1/0431/1157/9809/files/mosemugimekapawofab.pdf
- https://cdn.shopify.com/s/files/1/0430/6249/3345/files/rusuvuzutokusodabugabe.pdf
- https://cdn.shopify.com/s/files/1/0429/0763/1779/files/tupomorekaso.pdf
- https://cdn.shopify.com/s/files/1/0437/7437/8138/files/60848990854.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/32823332632.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000583f.bin` `b2c4d02bf525403ecbdaadae16ff234b99d9594a97338aef16f26dacd42810ff`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x583F	5312 bytes
`font_01_sfnt_off00006a30.bin` `c151c037bf8cb6b86261009382261b7f0fbaf90ef0c5ff20cd0f64214bdf970b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A30	10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.