PDF malware analysis — malicious · c6e213e219da4a9d

MALICIOUS

PDF

52.1 KB Created: 2020-09-02 01:40:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8be8fcf203c725c3ec486cd5c939af79 SHA-1: 65254ece156d0029fbfcefb12895706974371502 SHA-256: c6e213e219da4a9d5db94d3870d7c75359d16c8ea321f4a35259b004d4cb38b0

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to a malicious domain, disguised as a form for changing user information. This is a common social engineering tactic to trick users into visiting malicious sites. The PDF also contains a large number of external links, many of which point to benign content, suggesting a link farm or SEO poisoning attempt to mask the malicious redirector. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=sgk+e+bildirge+kullan%25C4%25B1c%25C4%25B1+de%25C4%259Fi%25C5%259Fikli%25C4%259Fi+formu
- https://static.usrfiles.com/ugd/dd6616_ce7897611ebc48e89c6ceb7a24285cc3.pdf
- https://static.usrfiles.com/ugd/469aea_d5e7d6decd8d459795e83c54e28c3460.pdf
- https://static.usrfiles.com/ugd/11f207_504e1cbb84184cc7ad9055d560881186.pdf
- https://cdn.shopify.com/s/files/1/0436/8531/4715/files/38283037687.pdf
- https://cdn.shopify.com/s/files/1/0457/6487/0300/files/inglourious_basterds_dual_audio_free.pdf
- https://cdn.shopify.com/s/files/1/0433/7300/2902/files/albuminuria_adalah.pdf
- https://cdn.shopify.com/s/files/1/0434/9391/6837/files/kiromukupetineju.pdf
- https://static.usrfiles.com/ugd/c1c462_56d681f2bd2e4697ac61d2ae42dbd977.pdf
- https://static.usrfiles.com/ugd/b50c55_d4bcf3b4d9d547049b5b15d7b0d17bfb.pdf
- https://static.usrfiles.com/ugd/b8c837_e2861ef9ee8442e4bafe2cbde97fde5e.pdf
- https://static.usrfiles.com/ugd/16a96a_4ace0d60209749eb8415a5a831eef163.pdf
- https://static.usrfiles.com/ugd/3eed2b_dd9f667abe4147cc9ec4e4a6f833bedc.pdf
- https://static.usrfiles.com/ugd/7f929b_70e8a0a7505d4530a16515155a0f06f3.pdf
- https://static.usrfiles.com/ugd/b8c837_affb6a93945c4d549595d45de0a7bee3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000075f6.bin` `d9c1475638e466997ce1dc3503480021230c524ff529e67d99bb5e47c66c4274`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75F6	5980 bytes
`font_01_sfnt_off000089c8.bin` `593aeaeb15ff6e01aeea2066f4c0a0111c3fdc0518f203d5a17387b04530a274`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x89C8	10952 bytes
`font_02_sfnt_off0000ac10.bin` `d14a31a02ce1c4152bb15d5126a0dec4416b44fa6c82943fd1949f8858d11b01`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAC10	16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.