PDF malware analysis — malicious · f07a1d78f011dd85

MALICIOUS

PDF

43.7 KB Created: 2020-07-08 19:46:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ab687274223a1080e53b179e50e9d54 SHA-1: 0cdf5a57cff54f19536ef6290351d40c840496fd SHA-256: f07a1d78f011dd85b8e922d4e407c53cf2188a37e729a9fac166686a3ab151f7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a deceptive link that redirects to malicious infrastructure, masquerading as a search result for a legal dictionary. This is supported by the PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM heuristics. The document body and embedded links indicate a lure to a potentially harmful website.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wb?keyword=black
- http://files.elevenbees.com/uploads/1/3/1/3/131398281/mitatito-namat-fovexenopekomig-lusuxa.pdf
- http://files.supervillesovak.com/uploads/1/3/2/7/132710575/juxemi.pdf
- http://files.marsjoyofpainting.com/uploads/1/3/1/6/131606127/1986964.pdf
- http://files.signaturegames.eu/uploads/1/3/1/4/131409709/ziguku_tubufaliz.pdf
- http://files.kinesiologie74.fr/uploads/1/3/2/7/132740384/xugezo.pdf
- http://files.sanmateolimos.com/uploads/1/3/1/3/131383553/612544a.pdf
- http://files.newhealthbydesign.com/uploads/1/3/2/6/132696280/jugekugobesideja.pdf
- http://files.morningglorygarden.com/uploads/1/3/2/6/132696263/pawopapujevubo.pdf
- http://files.instajeepthing.com/uploads/1/3/2/7/132710575/wosepumesog_lomevibufira_mixagibupa_tesikabedu.pdf
- http://files.maidtoshineservices.net/uploads/1/3/1/4/131437268/29f33e.pdf
- https://pavumowe.files.wordpress.com/2020/07/ponowisiwuwegu.pdf
- https://taribifu15544649.files.wordpress.com/2020/07/munup.pdf
- https://dexufef.files.wordpress.com/2020/07/xakoxalaput.pdf
- https://wadarosav408183356.files.wordpress.com/2020/06/14091262568.pdf
- https://gutelum.files.wordpress.com/2020/06/24487212466.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/32377204601.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/45366335679.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dosoxuwananeworatimuk.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/tovetutokukike.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gamusuzojikifikukudubug.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006b56.bin` `be22b8099a66eab96a9f823bc3346975d1a890874a404a0b98d32f370635ff81`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B56	5564 bytes
`font_01_sfnt_off00007e51.bin` `8357cab5c3238833f187756e2e6d0d3e53102072807f3a423fe43571d8beef04`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E51	10440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.