PDF malware analysis — malicious · f2714d3e9581102b

MALICIOUS

PDF

56.5 KB Created: 2020-08-18 14:53:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a8ac09447873a0b736413f14c095f24b SHA-1: 176961fa8a974f3e1e35218b152aa8463fac73f8 SHA-256: f2714d3e9581102b204bf331722cec549156b4f14e0a3a922f28f99724c261b0

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. The document also exhibits characteristics of a PDF link farm, with numerous embedded URLs pointing to external resources. The primary malicious URL is a redirector designed to lead users to further malicious content, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=university+of+alabama+football+news+bleacher+report
- http://nifegi.billymegawatt.com/uploads/1/3/1/4/131406082/zatevatupowesi.pdf
- http://mojuz.unitedmissionsofhope.org/uploads/1/3/0/8/130814328/riwopela_zimulolowuk_safasapo.pdf
- https://cdn.shopify.com/s/files/1/0432/2990/5058/files/xuradutiv.pdf
- https://cdn.shopify.com/s/files/1/0435/9385/9231/files/96991978252.pdf
- https://cdn.shopify.com/s/files/1/0437/6618/6135/files/65943290048.pdf
- https://cdn.shopify.com/s/files/1/0427/8986/3580/files/25759412293.pdf
- https://cdn.shopify.com/s/files/1/0429/8568/5153/files/guzos.pdf
- https://cdn.shopify.com/s/files/1/0437/5265/2951/files/48587618731.pdf
- https://cdn.shopify.com/s/files/1/0434/5082/6905/files/niroxo.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/febipak.pdf
- https://cdn.shopify.com/s/files/1/0434/5544/7202/files/78427681548.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/nowivozepax.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005eee.bin` `9aa724aab4fa4c5d592435552918aa6d54b1b8ad28defa29e2151b6f0ce5b693`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5EEE	6564 bytes
`font_01_sfnt_off00006f5e.bin` `c1aec01a81b61411a63b0e172845eb1cb974e173588919a1c28a6fc7a9d81e86`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F5E	5640 bytes
`font_02_sfnt_off00008271.bin` `9ae089f9bda0f301f49dec8737517060321ac5a6f311427d55fa63a3cf61554f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8271	5736 bytes
`font_03_sfnt_off000096b9.bin` `c4abc1903ac1e945384324e3bbaf4f762879729babd9bc305c75836bf483081b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x96B9	12508 bytes
`font_04_sfnt_off0000bf2c.bin` `35d3440dae1ebc896564e4e6f70ea95aa3a30a1ac603c7fffbb21b68b8b72e2f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBF2C	16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.