PDF malware analysis — malicious · ec89cbad4ec6eb6b

MALICIOUS

PDF

46.7 KB Created: 2020-08-30 14:25:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66d0d0457a7bf88b7bdd24b4d0dc3b07 SHA-1: 7aaa688e3c4d3c4a1bf90e719a6bf6f3bfad331c SHA-256: ec89cbad4ec6eb6bd4bbce822533b3bc06d90b90da1e4caa185b1d8be18cb0f7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded links, with one heuristic specifically flagging it as a 'PDF_SEO_LINK_FARM'. The primary malicious URL identified is 'https://ttraff.ru/wix?keyword=contemporary+english+version+catholi', which is categorized as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting an attempt to lure users to a malicious site. The file type and the nature of the links point towards a phishing or content-scraping attack.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=contemporary+english+version+catholi
- https://cdn.shopify.com/s/files/1/0432/7551/8107/files/2307136835.pdf
- https://cdn.shopify.com/s/files/1/0432/6581/8789/files/73738636128.pdf
- https://cdn.shopify.com/s/files/1/0457/0411/8428/files/adjective_phrase_and_noun_phrase_dif.pdf
- https://cdn.shopify.com/s/files/1/0439/9503/7854/files/26020618061.pdf
- https://cdn.shopify.com/s/files/1/0440/7921/8840/files/26707267982.pdf
- https://static.usrfiles.com/ugd/b8c837_9c6230a38605477197fdd2c6bfb057e7.pdf
- https://static.usrfiles.com/ugd/1be480_56cfb7e3c42943b4b62e49665e56163d.pdf
- https://static.usrfiles.com/ugd/b7306e_329837c2e3d848278fecbbfb1e3e2ee9.pdf
- https://cdn.shopify.com/s/files/1/0430/5348/2138/files/vodivum.pdf
- https://cdn.shopify.com/s/files/1/0431/5607/8758/files/business_analysis_process_model.pdf
- https://cdn.shopify.com/s/files/1/0428/7938/5756/files/pijuwem.pdf
- https://cdn.shopify.com/s/files/1/0433/1402/0505/files/64509670449.pdf
- https://cdn.shopify.com/s/files/1/0438/8447/8632/files/palaputosefu.pdf
- https://cdn.shopify.com/s/files/1/0430/6337/8081/files/agreesions_invade_nations.pdf
- https://cdn.shopify.com/s/files/1/0428/9075/6259/files/zavonudedowiwisenaw.pdf
- https://cdn.shopify.com/s/files/1/0435/1728/0408/files/29327558367.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0432/7551/8

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000078bf.bin` `b77d837bb4d9e86b42fcfab73cde44478acb3fc02ccb1cf6a9cbb56d9e0a22e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78BF	5416 bytes
`font_01_sfnt_off00008b0a.bin` `de54eed8c7558801b6c368e506b3a1539f95372db0d17ae6b7454443bddc828c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B0A	10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.