PDF malware analysis — malicious · d45561ebaab01637

MALICIOUS

PDF

52.9 KB Created: 2020-07-31 03:08:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7c68855080700740a91d9fe38825ad6e SHA-1: 1da20de0d8d3d08de13f5afdb1e92f710730bb7a SHA-256: d45561ebaab01637e4cd86df66ec297238817254e8cf01548805184ee69cb7e3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits characteristics of a link farm, embedding a significant number of external links, with a critical heuristic firing for PDF_SEO_LINK_FARM. One of these links, 'https://ttraff.ru/pify?keyword=psychoterapia+psychodynamiczna+zaburze%25C5%2584+osobowo%25C5%259Bci+pdf', is flagged as a malicious redirector. This suggests the document's primary purpose is to drive traffic to potentially harmful destinations, likely for SEO manipulation or to host malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=psychoterapia+psychodynamiczna+zaburze%25C5%2584+osobowo%25C5%259Bci+pdf
- http://files.hopeforhappy.com/uploads/1/3/1/3/131398093/logolu.pdf
- http://files.sfhenson.com/uploads/1/3/1/6/131607110/xisitepale-bewazi.pdf
- http://files.blowingsmokebbq.com/uploads/1/3/1/3/131384025/rudimatemeko.pdf
- http://files.madonnaforinspiration.com/uploads/1/3/2/3/132303134/856400.pdf
- http://files.lenreed.com/uploads/1/3/1/4/131453902/kijegidalitet_nakurovat_vimulij_fitisefetuzak.pdf
- https://cdn.shopify.com/s/files/1/0431/5712/7336/files/dorobovorom.pdf
- https://cdn.shopify.com/s/files/1/0431/1721/5905/files/vuwapubafowopudupeb.pdf
- https://cdn.shopify.com/s/files/1/0429/6045/3791/files/53956064869.pdf
- https://cdn.shopify.com/s/files/1/0434/1537/1932/files/67807226772.pdf
- https://cdn.shopify.com/s/files/1/0432/9078/7996/files/91683579989.pdf
- https://cdn.shopify.com/s/files/1/0431/3861/3415/files/bapetilowopuru.pdf
- https://cdn.shopify.com/s/files/1/0428/0100/4707/files/desadiwudofokuv.pdf
- https://cdn.shopify.com/s/files/1/0432/3095/3627/files/49552894564.pdf
- https://cdn.shopify.com/s/files/1/0432/2433/4496/files/27297100203.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/77330784460.pdf
- https://cdn.shopify.com/s/files/1/0429/7841/0655/files/zuvogofaputevixigebugeg.pdf
- https://cdn.shopify.com/s/files/1/0429/7211/9199/files/fasefofevavepugaso.pdf
- https://cdn.shopify.com/s/files/1/0432/8495/5300/files/82404191195.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008b1c.bin` `62783ff352706dddc1796876e5583a777445e5906f63336010079e2738319e6c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B1C	5960 bytes
`font_01_sfnt_off00009e80.bin` `84348fd98bffd9da22710c354bb31a42b470836fe1017e15123a42eafa23692a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9E80	11896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.