PDF malware analysis — malicious · d7f6a13045b771fb

MALICIOUS

PDF

41.9 KB Created: 2020-08-09 19:24:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4e6c65b7a269645c46fbef1e005695e5 SHA-1: 5f5397164a186f25e60a62fdad2c98b9e0406b3d SHA-256: d7f6a13045b771fb88ba8e86f5e00a9e7619c8cc7b2cd3c9ff2a78aa3816f023

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with a critical heuristic firing for a malicious redirector. The primary malicious URL identified is https://ttraff.cc/pify?keyword=abbyy+pdf+transformer, which is likely used to redirect users to a malicious site. The document body, though heavily obfuscated, contains references to 'Abbyy pdf transformer' and 'wkhtmltopdf', suggesting a lure to disguise the malicious intent. The presence of numerous links, many pointing to Shopify domains, further supports the SEO link farm heuristic.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=abbyy+pdf+transformer
- http://kelore.happislem.com/uploads/1/3/0/7/130775350/rabimunapivile.pdf
- http://files.inrhispantry.com/uploads/1/3/2/6/132681969/e9805e7c974.pdf
- http://lojanavub.rigonibakery.com/uploads/1/3/0/9/130969742/1417292.pdf
- https://cdn.shopify.com/s/files/1/0440/6044/2774/files/13835779753.pdf
- https://cdn.shopify.com/s/files/1/0449/0631/5943/files/business_proposal_example.pdf
- https://cdn.shopify.com/s/files/1/0430/3532/8663/files/81530539649.pdf
- https://cdn.shopify.com/s/files/1/0427/7354/5116/files/36445128841.pdf
- https://cdn.shopify.com/s/files/1/0433/9728/3992/files/57714435275.pdf
- https://cdn.shopify.com/s/files/1/0437/1467/4841/files/41259182401.pdf
- https://cdn.shopify.com/s/files/1/0432/4674/7803/files/ranger_subclasses_5e.pdf
- https://cdn.shopify.com/s/files/1/0434/4017/7317/files/savopetug.pdf
- https://cdn.shopify.com/s/files/1/0431/5096/6950/files/69817085529.pdf
- https://cdn.shopify.com/s/files/1/0427/8000/0422/files/64943011342.pdf
- https://cdn.shopify.com/s/files/1/0431/9097/6673/files/54596732276.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/letowopebofowebizuwir.pdf
- https://cdn.shopify.com/s/files/1/0428/7453/6103/files/77881333058.pdf
- https://cdn.shopify.com/s/files/1/0438/9571/8040/files/ielts_writing_tips_and_techniques.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006623.bin` `3466d679f7148db4b36b5f1d00cf4032053e3ee7bfc4e861b095aa1e3fb2f821`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6623	5384 bytes
`font_01_sfnt_off00007860.bin` `29c612c40161529d56e3d4fd7c91279032be7fa90baf71334c0edb8259bc9b2a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7860	10056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.