PDF malware analysis — malicious · f64bcafc16d8c9cd

MALICIOUS

PDF

59.9 KB Created: 2020-08-01 23:00:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 94054baaae241098006a757e94b9e519 SHA-1: ea437a45376e97cfed4fa9846f262c384c2bc052 SHA-256: f64bcafc16d8c9cdb2b825c8694b04bafa947b93716990550ded3bccfb2c09b7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with many links pointing to PDF files hosted on various domains. One critical heuristic identified a link to a known malicious redirector, https://ttraff.cc/pify?keyword=don+juan+lord+byron+pdf, which likely serves as the initial stage of a malicious download or phishing attempt. The document body itself contains garbled text but includes the same malicious redirector URL and several benign-looking Shopify URLs, suggesting a lure to download a PDF.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=don+juan+lord+byron+pdf
- http://files.aliawalston.com/uploads/1/3/1/6/131606815/levupuxupoj.pdf
- http://files.kiefferphotography.com/uploads/1/3/0/7/130739308/1337339.pdf
- http://files.cypressarbor.com/uploads/1/3/0/7/130739069/waxijo-majogasigemo-weselagodoxeleg-fefuvisa.pdf
- http://files.bootsanddiamonds.org/uploads/1/3/1/6/131637104/2916b958fa0ac79.pdf
- http://files.elkriverinvitational.com/uploads/1/3/1/6/131637224/dilupulex_xaviruvizedanel_dolejibofole.pdf
- https://cdn.shopify.com/s/files/1/0435/3910/3912/files/xorafut.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/74731072541.pdf
- https://cdn.shopify.com/s/files/1/0434/7772/9430/files/nijafujer.pdf
- https://cdn.shopify.com/s/files/1/0432/2187/6899/files/59367585904.pdf
- https://cdn.shopify.com/s/files/1/0433/3263/2730/files/93411485141.pdf
- https://cdn.shopify.com/s/files/1/0427/7973/8278/files/luvisokogezapawenojax.pdf
- https://cdn.shopify.com/s/files/1/0433/5029/4678/files/74196340681.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/mojedisubeweful.pdf
- https://cdn.shopify.com/s/files/1/0430/7045/5957/files/nexogamilive.pdf
- https://cdn.shopify.com/s/files/1/0431/7321/6411/files/45652621861.pdf
- https://cdn.shopify.com/s/files/1/0428/0346/2303/files/tikevatubexirefojak.pdf
- https://cdn.shopify.com/s/files/1/0432/6467/1909/files/41264742185.pdf
- https://cdn.shopify.com/s/files/1/0441/0572/8152/files/vudonevimevikifuda.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ad55.bin` `6bd2fcd5f461dcd21ac49e17761fb441d9e34b59b76a1dffb256c9899bffa5ce`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAD55	5172 bytes
`font_01_sfnt_off0000bf0d.bin` `21a7e2ce348c2b46409f78c5db6a57e39c3354060aed7a62d323214078534f52`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBF0D	10388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.