PDF malware analysis — malicious · dff542666d0e9f2d

MALICIOUS

PDF

52.9 KB Created: 2020-08-11 13:54:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ad932eaef6ba0668c371866fe641c5f SHA-1: fbc80b88e6617b2bb914402b09b9c756ddbf8ee1 SHA-256: dff542666d0e9f2d0029828d50388b740384a1f010e69e069baa623141f044a8

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector identified by heuristics. This suggests the PDF is designed to redirect users to malicious sites, potentially for further exploitation or phishing.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=how+to+ensure+validity+and+reliability+in+research+pdf
- http://files.fishuntessentials.com/uploads/1/3/1/4/131406751/a30e222743.pdf
- http://files.kimatangles.com/uploads/1/3/0/8/130874480/5914744.pdf
- http://files.believerschurchleander.com/uploads/1/3/1/1/131163859/6f51491c6d.pdf
- http://files.landscapeequipmentrentals.com/uploads/1/3/0/9/130969695/8005805.pdf
- http://files.alatebloomer.net/uploads/1/3/1/6/131608016/paripunomipeni-dalatanezu.pdf
- https://cdn.shopify.co
- https://cdn.shopify.com/s/files/1/0431/6423/7992/files/vovarexezoduzemuta.pdf
- https://cdn.shopify.com/s/files/1/0439/4834/3464/files/apprendre_la_conjugaison_anglaise.pdf
- https://cdn.shopify.com/s/files/1/0431/7957/3414/files/nakazugaravudoram.pdf
- https://cdn.shopify.com/s/files/1/0429/7854/1722/files/muscle_gain_workout_schedule.pdf
- https://cdn.shopify.com/s/files/1/0438/4299/4336/files/37443837689.pdf
- https://cdn.shopify.com/s/files/1/0434/4738/6264/files/air_pollution_control_download.pdf
- https://cdn.shopify.com/s/files/1/0434/7274/8710/files/ziwotagonalepumuled.pdf
- https://cdn.shopify.com/s/files/1/0433/5822/4549/files/gukanuxonedupubabozita.pdf
- https://cdn.shopify.com/s/files/1/0428/2528/5798/files/30599222590.pdf
- https://cdn.shopify.com/s/files/1/0433/2866/7816/files/centos_6_network_configuration.pdf
- https://cdn.shopify.com/s/files/1/0438/4971/1781/files/gojurefogosuxalago.pdf
- https://cdn.shopify.com/s/files/1/0431/5670/1346/files/73251279254.pdf
- https://cdn.shopify.com/s/files/1/0439/1400/2587/files/non_aqueous_titration_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009035.bin` `24a0607e0045395774db2b3dfefc96ed2b57afceeeca6472670ecd7d760ae3c1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9035	5596 bytes
`font_01_sfnt_off0000a34d.bin` `b4fef8aa7f62c9b14e88c0a78c0538583c693c7adfaa63f6bb05deab0f08a280`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA34D	10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.