PDF malware analysis — malicious · e7c0c049261a8a3d

MALICIOUS

PDF

45.5 KB Created: 2020-08-16 02:24:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 01dedfe7a73bd1b6ce9dc5318d5c917b SHA-1: 5b375f55fe03a93a7eca486958d2665fb2223af4 SHA-256: e7c0c049261a8a3d04f3a36cdbdd90b2a7ffeb503b9f76e40e6e6f58fcac9901

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous links, many of which point to external resources, including a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for a tutorial on C++ generics, directing users to the malicious URL. This suggests a phishing or social engineering attack aimed at redirecting users to malicious infrastructure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wb?keyword=generics%20in%20c#%20tutorial%20pdf
- http://files.sparetimewooddesign.com/uploads/1/3/1/3/131382430/revozi_wijelile_gijijagafiba_zoxotewodi.pdf
- http://wigubowig.salemorthodoxchurch.org/uploads/1/3/1/8/131871390/lezunaz.pdf
- http://files.funcde.com/uploads/1/3/0/7/130739284/regamotukofamepit.pdf
- http://files.tenneyband.org/uploads/1/3/0/7/130776131/9400016.pdf
- https://cdn.shopify.com/s/files/1/0435/5417/7185/files/nanevomewe.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/72645751706.pdf
- https://cdn.shopify.com/s/files/1/0430/2965/9797/files/melitule.pdf
- https://cdn.shopify.com/s/files/1/0428/3128/2335/files/90072675614.pdf
- https://cdn.shopify.com/s/files/1/0450/6569/9478/files/the_hunger_games_watch_online.pdf
- https://cdn.shopify.com/s/files/1/0438/4774/5698/files/tessa_blanchard_theme_song.pdf
- https://cdn.shopify.com/s/files/1/0451/8959/5287/files/ajax_get_all_form_data.pdf
- https://cdn.shopify.com/s/files/1/0435/9713/6030/files/25487456394.pdf
- https://cdn.shopify.com/s/files/1/0429/4161/2199/files/54023845341.pdf
- https://cdn.shopify.com/s/files/1/0428/7715/7542/files/67630818245.pdf
- https://cdn.shopify.com/s/files/1/0431/3448/4648/files/39234085233.pdf
- https://cdn.shopify.com/s/files/1/0453/9387/1016/files/88576039554.pdf
- https://cdn.shopify.com/s/files/1/0434/9476/8802/files/67145877820.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005fa2.bin` `3b6cef37bed91b303a765cddfce4e5cf8934070014be5797f02dabc46fbfc4f2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FA2	4180 bytes
`font_01_sfnt_off00006dc8.bin` `f67a11b5c058d0549ea908d8a9b682f6f3a4d4f2c63846cd6cf70ef08c9f9b6b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6DC8	14484 bytes
`font_02_sfnt_off00009b2f.bin` `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9B2F	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.