PDF malware analysis — malicious · cbe1b6cc0557ee66

MALICIOUS

PDF

169.4 KB Created: 2020-08-15 00:52:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: af69eb534138482a84ef1a2f95def8d7 SHA-1: 04c3bbaf0a3b657dee7174a07ef937ab1f71bd4c SHA-256: cbe1b6cc0557ee668a351a8d82dc6bcc7c9b8743c16fee1530e19aaf926e007b

108 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains heuristics indicating it is a malicious redirector link and uses lures common in advance-fee scams, such as parcel delivery or fake invoices. The primary malicious URL identified is https://ttraff.ru/pify?keyword=employee+biographical+data+sheet%2528+end%2529. No scripts were extracted, but the document structure and embedded URL strongly suggest a phishing or scam attempt.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=employee+biographical+data+sheet%2528+end%2529 In PDF document text
- http://files.edenspringsfarm.org/uploads/1/3/0/9/130969480/367857.pdfIn PDF document text
- http://furop.reflectivebounce.com/uploads/1/3/1/3/131398140/tadika.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/1163/6381/files/international_players_anthem_lyrics.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0439/2094/9416/files/24408565194.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/7248/6566/files/90688815556.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/8709/4177/files/90854761859.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/2224/4250/files/resto_druid_bfa.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/1064/4377/files/basic_calculus_formulas.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/2756/1634/files/detuvidogadofuxexago.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/8992/8096/files/niwebojimejativu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00024be1.bin` `6dec503a894f71a8912bf1be1bf71b678b8b18fa9e805ba1f2f7d6f6931fe549`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x24BE1	5628 bytes
`font_01_sfnt_off00025ee8.bin` `70bcf723d43a7cb77d6394c6b9717aa66c412caeb048ae19a00637e5e71d23c2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x25EE8	13544 bytes
`font_02_sfnt_off00028a2b.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x28A2B	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.