PDF malware analysis — malicious · d07c691f1314da67

MALICIOUS

PDF

78.6 KB Created: 2020-08-05 16:16:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3e1ed93a625fb7f0cade2e15ced74c7f SHA-1: 7e3b4aba4e753753f125c0d06c617380a0fbe86a SHA-256: d07c691f1314da67317880a8b0de1a1301b438161c10c57c8327ec3496fd3d80

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains multiple embedded links, including one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector. This suggests the PDF is designed to lead users to malicious infrastructure, likely for further exploitation or phishing.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=acopio+de+informacion+metodologia+pdf
- http://files.jgeconstruction.com/uploads/1/3/1/4/131409333/70df5777b77.pdf
- http://files.stincrowvoden.com/uploads/1/3/1/0/131069978/bafefeludebosib.pdf
- http://files.shiragirlschoir.org/uploads/1/3/0/9/130969811/5364685.pdf
- http://files.skyhighclubcaligroup.com/uploads/1/3/2/6/132681767/gibapeka_tevuvupomido_wowezevuvu.pdf
- http://paval.downtowndogs.ca/uploads/1/3/0/8/130813054/3003874.pdf
- https://cdn.shopify.com/s/files/1/0431/2491/6388/files/46193383153.pdf
- https://cdn.shopify.com/s/files/1/0431/8458/6909/files/36521693806.pdf
- https://cdn.shopify.com/s/files/1/0429/6795/7658/files/72598852654.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/23582012054.pdf
- https://cdn.shopify.com/s/files/1/0433/7949/0968/files/90509460509.pdf
- https://cdn.shopify.com/s/files/1/0429/1559/4393/files/38669125157.pdf
- https://cdn.shopify.com/s/files/1/0433/1687/1333/files/kabbalah_italiano.pdf
- https://cdn.shopify.com/s/files/1/0434/0210/0899/files/jugewibesalupemademejara.pdf
- https://cdn.shopify.com/s/files/1/0437/5193/2065/files/jorali.pdf
- https://cdn.shopify.com/s/files/1/0434/1966/4541/files/89275137606.pdf
- https://cdn.shopify.com/s/files/1/0435/7708/2019/files/maulana_abul_kalam_azad_books_in_urdu.pdf
- https://cdn.shopify.com/s/files/1/0447/0787/2921/files/mark_de_lisle_navy_seal_workout.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0429/6795/7658/files/72598852

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000df9a.bin` `c91fb8b4b66edfd1a155bfa00af694a44d9233afba32f2741d32a5c23d344841`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF9A	5072 bytes
`font_01_sfnt_off0000f0b6.bin` `31fa2b74f5f5ce642176306c7a543b5458da7412a7620f75a443a190ee7e1426`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF0B6	14732 bytes
`font_02_sfnt_off00011cda.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11CDA	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.