PDF malware analysis — malicious · e2b71c423e21c8b4

MALICIOUS

PDF

51.5 KB Created: 2020-08-03 05:20:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 57eceda6e00d01aaa500d2b86fe218c1 SHA-1: 66560bc437758d02b550aa6c253b4d1f2760ea18 SHA-256: e2b71c423e21c8b462d7fc0638f4a6cb9b2167095bf9df3b33a870e567c5f738

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded links, with one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to a 'game' and a URL that appears to be part of a link farm. The presence of numerous external links suggests an attempt to lure users to malicious websites, potentially for phishing or malware distribution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=dennis+gustafsson+game
- http://files.regionalpropertynsw.com/uploads/1/3/2/6/132681863/buzesuzavekoral-lizufozememisid-lebumaponepov-bejaxedavev.pdf
- http://files.nyingma-summer-seminar.com/uploads/1/3/1/4/131406663/xufojowuk_toboraju_pemodibatimamam_soboduritibesok.pdf
- http://files.vanessaarmandtesol.com/uploads/1/3/0/7/130775025/6b7280b.pdf
- http://files.shopraebtq.com/uploads/1/3/1/1/131163540/3b6af38f92d10.pdf
- http://fupobu.woburnxctrack.com/uploads/1/3/1/3/131383949/1f8f7326228c.pdf
- https://cdn.shopify.com/s/files/1/0428/3459/1907/files/56586298899.pdf
- https://cdn.shopify.com/s/files/1/0431/6227/1898/files/solulosibes.pdf
- https://cdn.shopify.com/s/files/1/0428/2921/7958/files/39812701701.pdf
- https://cdn.shopify.com/s/files/1/0430/9005/1221/files/takizoxakuribadijiz.pdf
- https://cdn.shopify.com/s/files/1/0430/2936/4889/files/1793003708.pdf
- https://cdn.shopify.com/s/files/1/0430/8818/3456/files/gefusififofamade.pdf
- https://cdn.shopify.com/s/files/1/0436/0349/3022/files/83355718164.pdf
- https://cdn.shopify.com/s/files/1/0427/6623/7852/files/vuwuzepib.pdf
- https://cdn.shopify.com/s/files/1/0431/4375/7992/files/82347868375.pdf
- https://cdn.shopify.com/s/files/1/0434/0878/5562/files/fufifofolokifemabapufovi.pdf
- https://cdn.shopify.com/s/files/1/0431/1564/3031/files/9365090554.pdf
- https://cdn.shopify.com/s/files/1/0427/7927/9527/files/zedabuxozusavudoxa.pdf
- https://cdn.shopify.com/s/files/1/0431/8937/1044/files/bakiv.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008c16.bin` `74b3ffa500d057e4bdce0efe1547d6699705c5b9b471423ab7ce57d6cae456ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C16	4956 bytes
`font_01_sfnt_off00009cf6.bin` `92730da634aee598aa0d3663634a6faa7d8ee8bbc436245c305446b8d776faea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9CF6	10448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.