PDF malware analysis — malicious · ead6ef9d43e43310

MALICIOUS

PDF

45.9 KB Created: 2020-07-30 18:44:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 94b510bca60cb4cdc4550e42b7b724f6 SHA-1: a9633942f14ef75cbb5cdc3a9a753433eb7e5a8c SHA-256: ead6ef9d43e43310971cc354bedc57be6c159b29aa9a557bad0b486e0ddede8c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link and a link farm, indicating an attempt to drive traffic to external sites. The embedded URL and the document body text suggest a lure for downloading files, specifically mentioning 'calligraphy worksheets pdf free download'. The primary malicious IOC is the redirector URL, which likely leads to further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=calligraphy+worksheets+pdf+free+download
- http://files.loribeliharboyd.com/uploads/1/3/2/7/132712206/revafitawevatoj.pdf
- http://files.jpriceconsulting.com/uploads/1/3/1/3/131378780/0ca4749c86ad8.pdf
- http://files.rohetrackera.com/uploads/1/3/1/4/131455337/9821575.pdf
- http://files.podicongo.com/uploads/1/3/0/7/130775518/jewalafoki-wubijesajek-texofurojefaxed-susomesig.pdf
- http://files.newyorkstategrandcouncil.com/uploads/1/3/1/4/131437538/bapemo.pdf
- http://files.podicongo.com/uploads/1/3/0/7/130775518/jewalafoki-wubije
- https://cdn.shopify.com/s/files/1/0432/4396/2532/files/nefapom.pdf
- https://cdn.shopify.com/s/files/1/0436/0008/5149/files/25344032571.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/48465164240.pdf
- https://cdn.shopify.com/s/files/1/0440/3891/4213/files/93718934425.pdf
- https://cdn.shopify.com/s/files/1/0437/1021/8391/files/24276551188.pdf
- https://cdn.shopify.com/s/files/1/0437/5419/3047/files/xakofit.pdf
- https://cdn.shopify.com/s/files/1/0431/5830/6965/files/97145899238.pdf
- https://cdn.shopify.com/s/files/1/0436/1538/7811/files/32559164103.pdf
- https://cdn.shopify.com/s/files/1/0433/9495/7466/files/70116363722.pdf
- https://cdn.shopify.com/s/files/1/0430/4227/5485/files/68027117251.pdf
- https://cdn.shopify.com/s/files/1/0432/4042/3592/files/zunefad.pdf
- https://cdn.shopify.com/s/files/1/0437/7152/7325/files/74429008107.pdf
- https://cdn.shopify.com/s/files/1/0436/1817/3086/files/kufewovovopapuw.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007681.bin` `376aecfc38f4297d20bca2ed3f1dff7a7f8db4a7fa7b537d0612cbb73503901e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7681	5372 bytes
`font_01_sfnt_off000088d7.bin` `1ae73ec9c6d54ff8b196938ccb58475cb49075195492b9645412cc267955c09c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88D7	9864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.