PDF malware analysis — malicious · cbdcc408ea225d3b

MALICIOUS

PDF

34.9 KB Created: 2020-09-01 01:36:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fe1a1d98e99d92ff007d216504a80bd7 SHA-1: 3f7590a11ac5392e0a78ea3022b69d6955cf5ffc SHA-256: cbdcc408ea225d3b8af7cdde5be76d15f37a5049993373a180f7e90cdb396a66

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be a lure for 'Formica laminate sheet samples'. This URL redirects to a malicious domain, suggesting a phishing or scam attempt. The presence of numerous other links, many pointing to Shopify, indicates a potential link farm used for SEO poisoning or distributing malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=formica+laminate+sheet+samples In PDF document text
- https://cdn.shopify.com/s/files/1/0434/0734/3772/files/loxakajugupozapatogit.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/7649/9096/files/mw3_hack_xbox_360.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/4509/3530/files/html_code_formatter_eclipse.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0427/8000/0422/files/the_architect_s_handbook_of_professional_practice_15th_edition.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/1619/1125/files/36930899895.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/5684/0350/files/29307515290.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/7437/8138/files/xatojoxege.pdfIn PDF document text
- https://static.usrfiles.com/ugd/4d400c_ccd8ebe406d74726b71b77c20499ec62.pdfIn PDF document text
- https://static.usrfiles.com/ugd/ac72e0_3a3fd945046b422cb3e6d05cb26bd984.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/6694/9799/files/vande_mataram_ringtone_my_mobile.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pejuzesuloroxutebed.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/0923/6374/files/illinois_boat_bill_of_sale.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004b96.bin` `16ea7add74c298d0d1980f101b75f3d2637bdb6cdbc8844c0dc7e1a4d679b0b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4B96	5128 bytes
`font_01_sfnt_off00005cdc.bin` `5365d1ad6b77216f16ccc3c1702c961d5f82928db93517890731111e3d3fec2b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5CDC	10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.