PDF malware analysis — malicious · e495cb984f61c2b8

MALICIOUS

PDF

51.1 KB Created: 2020-07-31 12:07:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 92983a3f7b7f83776969c7071ca9416f SHA-1: 76a69b2a1b88088c062dbf77be3dfcd007c4c5d3 SHA-256: e495cb984f61c2b8a056cea3264913ca347ee93c6622ba5829562f56771c8620

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains embedded links that redirect to known malicious infrastructure, specifically a redirector at 'ttraff.cc'. The document body, though heavily obfuscated, appears to be a lure related to 'refractive index' to entice clicks. The presence of numerous external PDF links, many hosted on Shopify, suggests a link farm or SEO poisoning tactic to increase visibility and drive traffic to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=refractive+index+of+a+triangular+glass+prism+pdf
- http://files.piano-together.com/uploads/1/3/1/4/131453276/xelun.pdf
- http://files.designkimhornburg.com/uploads/1/3/0/7/130775982/c5f4d8.pdf
- http://files.inhistrenches.com/uploads/1/3/1/1/131163788/0b5ee74.pdf
- http://files.bebrandconfident.live/uploads/1/3/0/7/130739225/7c2cef4d750.pdf
- http://files.piano-to
- https://cdn.shopify.com/s/files/1/0427/9477/8791/files/dufalugaxusatig.pdf
- https://cdn.shopify.com/s/files/1/0427/3651/7286/files/10768037470.pdf
- https://cdn.shopify.com/s/files/1/0433/4852/5208/files/41686467404.pdf
- https://cdn.shopify.com/s/files/1/0434/8710/1094/files/39300929083.pdf
- https://cdn.shopify.com/s/files/1/0433/5458/7288/files/pirisolidumom.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/ziwodukujaluladiludu.pdf
- https://cdn.shopify.com/s/files/1/0431/1220/2389/files/22857758181.pdf
- https://cdn.shopify.com/s/files/1/0430/3175/6957/files/69576494190.pdf
- https://cdn.shopify.com/s/files/1/0435/9228/6363/files/lumewudaloxodusalafisob.pdf
- https://cdn.shopify.com/s/files/1/0437/7251/0362/files/befukedidisag.pdf
- https://cdn.shopify.com/s/files/1/0431/1734/6976/files/58502202220.pdf
- https://cdn.shopify.com/s/files/1/0434/4617/3852/files/31006215817.pdf
- https://cdn.shopify.com/s/files/1/0433/4449/4750/files/38665289928.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000713a.bin` `bf532e56099ab8dee9e5ba844e7d5a2e3832b30b2e941b2b8dd7bd42fea01972`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x713A	5492 bytes
`font_01_sfnt_off000083df.bin` `5a2105e17a20e690ec765c1b88feb5f7e1a9f0600378880d274280e094204fab`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83DF	10608 bytes
`font_02_sfnt_off0000a7e0.bin` `5d5b0e224bd590c995eb33b81ab20531bd12a666fe790401a9499e2cadaf90b9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA7E0	16460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.