PDF malware analysis — malicious · f433833c491d5055

MALICIOUS

PDF

38.5 KB Created: 2020-08-10 06:53:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b6026e1c8c1db213755b82e52096f34e SHA-1: 4e01a71c5deb26b5e729a9b55e174024d5f78437 SHA-256: f433833c491d50550187809c3aafd32bbc3efde7cc636792b9cd2107d57a9215

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a large number of embedded links, with a critical heuristic firing for a malicious redirector. The document body, though malformed, suggests a lure related to 'weekly horoscope in telugu pdf'. The primary malicious IOC is the redirector URL, which is likely used to funnel victims to a phishing or malware distribution site. The presence of numerous Shopify-hosted PDFs suggests a link farm technique to improve SEO for malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=weekly+horoscope+in+telugu+mulugu+pdf
- http://pimurig.chhsseniors.com/uploads/1/3/1/6/131636612/c9b5523906.pdf
- http://files.cffhaw.com/uploads/1/3/1/4/131453214/gibodarinofazen.pdf
- http://files.ladymaeimpressions.com/uploads/1/3/1/3/131379434/ba398.pdf
- http://files.innerheartpathways.com/uploads/1/3/1/4/131408970/dc22471b539454.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/97428896976.pdf
- https://cdn.shopify.com/s/files/1/0429/8558/6849/files/92668928355.pdf
- https://cdn.shopify.com/s/files/1/0432/6785/0390/files/banofekanodazex.pdf
- https://cdn.shopify.com/s/files/1/0435/4473/9999/files/canon_in_d_piano_easy.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/21884581804.pdf
- https://cdn.shopify.com/s/files/1/0447/0882/3193/files/definition_of_religion_by_scholars.pdf
- https://cdn.shopify.com/s/files/1/0433/2224/5273/files/84036609193.pdf
- https://cdn.shopify.com/s/files/1/0437/1437/9930/files/3d_max_basics.pdf
- https://cdn.shopify.com/s/files/1/0431/4087/4408/files/historia_de_los_derechos_humanos_en_el_salvador.pdf
- https://cdn.shopify.com/s/files/1/0437/3345/0903/files/ignou_assignment_submission_form.pdf
- https://cdn.shopify.com/s/files/1/0437/8873/0525/files/56132177417.pdf
- https://cdn.shopify.com/s/files/1/0430/1229/2767/files/31894359653.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000599f.bin` `c986d6702eddf157dc4ce2adfd60e86372b70814625633a66dd4fcd5d67fadc2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x599F	5540 bytes
`font_01_sfnt_off00006c67.bin` `b66752d5aed76a93af6580962a1ecdb1192c33aedbfd2cd6b1e87b29ef1da600`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C67	9468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.