PDF malware analysis — malicious · c941ad01143b3e4b

MALICIOUS

PDF

48.3 KB Created: 2020-08-25 01:43:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5e34379cabe1ec128e7f7c1f88049447 SHA-1: b04b45fe4130c6416673ee0a15ff3db282db9906 SHA-256: c941ad01143b3e4b12f352585be2a8a9478de2739d85f5796c80a21adf54046d

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a high number of embedded links, many pointing to Shopify domains, but one critical link redirects to a known malicious redirector at 'ttraff.cc'. The document body, though heavily obfuscated, contains the malicious URL and appears to be a lure related to 'Jio 4g lte network app'. The presence of a callback phishing lure heuristic further supports the malicious intent of directing users to external resources. No scripts were extracted from this sample.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=jio+4g+lte+network+app
- http://files.4loveofbaskets.com/uploads/1/3/1/6/131636651/kotoku.pdf
- https://cdn.shopify.com/s/files/1/0458/1693/8662/files/video_barongan_jawa_timur.pdf
- https://cdn.shopify.com/s/files/1/0433/1782/1605/files/pisimolujusog.pdf
- https://cdn.shopify.com/s/files/1/0432/7692/7142/files/50134310252.pdf
- https://cdn.shopify.com/s/files/1/0431/7216/7841/files/letideripasekun.pdf
- https://cdn.shopify.com/s/files/1/0431/6856/3355/files/vepirodonazevebumidepivel.pdf
- https://cdn.shopify.com/s/files/1/0439/4595/1400/files/blackroots_science_2nd_edition.pdf
- https://cdn.shopify.com/s/files/1/0435/2960/1175/files/75178021801.pdf
- https://cdn.shopify.com/s/files/1/0431/3006/0955/files/528329090.pdf
- https://cdn.shopify.com/s/files/1/0438/4089/7189/files/98064613720.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d43.bin` `cd2358c14abcef8b1fbe9fd9638b2f28469c6df049c6ee186b58c0983099229b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D43	4832 bytes
`font_01_sfnt_off00006dcb.bin` `45f26e132e0122fcbef883bb75b9824c03b9dc2dba290ccb15b2ab9a2f4c03f1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6DCB	10376 bytes
`font_02_sfnt_off0000916d.bin` `ebd2804bff382343e08f6a42dc45f69f4e794c08b23908ae60ba78ededae74b1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x916D	16164 bytes
`font_03_sfnt_off0000a685.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA685	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.