PDF malware analysis — malicious · de3cbc003d6fd683

MALICIOUS

PDF

34.4 KB Created: 2020-09-04 05:49:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c0053e2f59dee5cc8d91e7533b659d21 SHA-1: b25cf85c246bb63a70ae75c429d0ccce91c69d97 SHA-256: de3cbc003d6fd6838d08b27da0d4cfab8c1a243395371b72d7d42f791c2be3d6

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a lure suggesting it is a technical document about an 'Autonics inductive proximity sensor pdf'. However, it embeds a link that redirects to a malicious domain, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The SE_BROWSER_INSTALL_LURE heuristic indicates the document's content is designed to trick the user into installing something, likely malware, by clicking the malicious link. The PDF_SEO_LINK_FARM heuristic further suggests a pattern of creating numerous linked PDFs, likely for SEO manipulation or to distribute malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=autonics+inductive+proximity+sensor+pdf
- https://static.usrfiles.com/ugd/ae15ca_9163b43e43754267ab0ed0865b5bd9cb.pdf
- https://static.usrfiles.com/ugd/4ae4db_8d5e93c7748249c2a478868162bcd907.pdf
- https://static.usrfiles.com/ugd/269bb8_8f5c14a6855648f8b818166b626a2fbd.pdf
- https://static.usrfiles.com/ugd/162fe6_af8647240e244f2080a8bd13f681faaf.pdf
- https://static.usrfiles.com/ugd/696117_80b1d3295dda4f4f825657b9ab3f9c58.pdf
- https://static.usrfiles.com/ugd/b4f0c6_60581a63bb004ecba811d0a6c7a9ab1a.pdf
- https://static.usrfiles.com/ugd/3ceeb9_073771534c60487abbf02c82281cc015.pdf
- https://cdn.shopify.com/s/files/1/0427/4782/2236/files/1206488860.pdf
- https://cdn.shopify.com/s/files/1/0433/8856/7706/files/dasixapese.pdf
- https://cdn.shopify.com/s/files/1/0428/5526/8518/files/on_purpose_sabrina_carpenter_piano_sheet_music.pdf
- https://cdn.shopify.com/s/files/1/0431/5702/9019/files/xuvopikinaxipadikuxiran.pdf
- https://cdn.shopify.com/s/files/1/0432/7918/8118/files/salary_breakup_format.pdf
- https://cdn.shopify.com/s/files/1/0433/4324/9563/files/fipudozetigevopuvusus.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004a73.bin` `2cbd50ef7a116467fdcabdc7aa8ac51d7d1892b8cbd7680f8d0c0e0ae50b33a5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4A73	5280 bytes
`font_01_sfnt_off00005c69.bin` `27937f1d2e6a268b502bbffada6b4a3c96b2b198e3568ececf6beed0e49a6520`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C69	9500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.