PDF malware analysis — malicious · e9515ccc2839496a

MALICIOUS

PDF

46.2 KB Created: 2020-07-16 16:05:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a684a1d4149dc1005c9ebfa56e5ff9ea SHA-1: 9c75cb10ed44575fc4ebb5609c6065c3917385aa SHA-256: e9515ccc2839496a5d9c20961d7149adbc3277af473ec7a8ee7a53af211820a3

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on various domains. One of the primary links directs to a known malicious redirector, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to 'baby girl nicknames in telugu pdf'. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wb?keyword=baby%20girl%20nicknames%20in%20telugu%20pdf
- http://files.pastyandpie.com/uploads/1/3/1/4/131483440/dunevabamumafanamato.pdf
- http://files.ldceny.net/uploads/1/3/1/4/131407284/8363423.pdf
- http://files.tadeaspriklopil.net/uploads/1/3/1/3/131379034/3589358.pdf
- http://files.legacyoptic.com/uploads/1/3/2/3/132302764/nalujuwexize_lowel_biposusebufimu.pdf
- http://files.etiquetteeveryday.net/uploads/1/3/1/0/131070202/9743441.pdf
- https://koxopovobepe.files.wordpress.com/2020/07/82416785967.pdf
- https://baleboloj.files.wordpress.com/2020/07/fafukezabafozibodamaje.pdf
- https://zuxaxite.files.wordpress.com/2020/06/fegirejuzipe.pdf
- https://fevonag.files.wordpress.com/2020/07/nujetikenogobu.pdf
- https://jorerego.files.wordpress.com/2020/07/beligezaxizilerafuk.pdf
- https://leniwibi.files.wordpress.com/2020/07/62687455651.pdf
- https://cdn.shopify.com/s/files/1/0431/0840/1316/files/genunugegufe.pdf
- https://cdn.shopify.com/s/files/1/0430/0210/1923/files/kunawoniju.pdf
- https://cdn.shopify.com/s/files/1/0431/1924/7514/files/19773862327.pdf
- https://cdn.shopify.com/s/files/1/0432/0978/5512/files/23881568539.pdf
- https://cdn.shopify.com/s/files/1/0433/3201/0152/files/gunujapuxitevibupume.pdf
- https://cdn.shopify.com/s/files/1/0431/1531/5351/files/papenudomemugozasu.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/vabagibad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000075d7.bin` `1ee24f53b6f4690b3716ebaa936f8540f3f3e71eca2927b3e9c857ab69448ae3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75D7	5600 bytes
`font_01_sfnt_off000088c6.bin` `a480533cd63d3ab7341f16d9ed24b8e3060cbd2560c9993c3e651c18773cb37d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88C6	10324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.