PDF malware analysis — malicious · e71d4972d794a3fd

MALICIOUS

PDF

74.1 KB Created: 2020-08-07 02:43:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3bdcff51f94f9dc9404e5438a4c8fb77 SHA-1: c531876419c208758a10eeb655646d1f8f96606f SHA-256: e71d4972d794a3fdcff26225dfadbddd8d0cba3cec570aa356bf548201e3744d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which are disguised as PDF files hosted on various domains. One of these links, https://ttraff.cc/pify?keyword=acetobacter+xylinum+pdf, is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it is the primary lure. The presence of numerous links points to a link farm or SEO poisoning tactic to distribute malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=acetobacter+xylinum+pdf
- http://files.medusa.org.au/uploads/1/3/1/3/131384709/mixojirogixovi_lipojufubipila_jabazu.pdf
- http://notimo.livelifeunbroken.com/uploads/1/3/1/4/131407921/rizekamanuturanasi.pdf
- http://files.streetbridgeinn.com/uploads/1/3/0/7/130776118/penoragikonun-zewinekonewipo-wifupapes.pdf
- http://files.iraqi-poet.net/uploads/1/3/0/7/130739810/milaku-wirerewizup-wuzik.pdf
- https://cdn.shopify.com/s/files/1/0432/7417/4632/files/abbyy_finereader_torrentino.pdf
- https://cdn.shopify.com/s/files/1/0431/1711/7589/files/50747005909.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/62386903812.pdf
- https://cdn.shopify.com/s/files/1/0429/6438/5951/files/74394654376.pdf
- https://cdn.shopify.com/s/files/1/0433/2742/2632/files/83185822361.pdf
- https://cdn.shopify.com/s/files/1/0440/1650/0886/files/halloween_history_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zemivok.pdf
- https://cdn.shopify.com/s/files/1/0428/3065/9751/files/46345107038.pdf
- https://cdn.shopify.com/s/files/1/0434/7563/2285/files/94250577729.pdf
- https://cdn.shopify.com/s/files/1/0429/4197/2636/files/13456379785.pdf
- https://cdn.shopify.com/s/files/1/0432/9380/2646/files/58655993882.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c65a.bin` `b27d55c9981a9a5a1947ee8a30ebab89fe0c86b52b6002417023e6213d2818ac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC65A	5420 bytes
`font_01_sfnt_off0000d8c2.bin` `33b9aa214af78920879c9b28845eb70faa200ceee8db60a90d1428e94b205a14`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD8C2	16424 bytes
`font_02_sfnt_off0001044d.bin` `ebaa9d42c58e3fd25c8264bcf4ef2319fee467c92cf53dcc1f377a20fc8d39b0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1044D	16148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.