PDF malware analysis — malicious · f7340e043feaf8cd

MALICIOUS

PDF

33.6 KB Created: 2020-08-20 03:19:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4e583f5fb2daf2b85497bdcb5c347bdf SHA-1: ae3170dcd4d90d29bfa00acb58fe6f8f45c41662 SHA-256: f7340e043feaf8cd4e24fea7237aad58b4b0d3522a6b60f870ddf9f8c721a89e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for redirecting users to malicious sites. One prominent link, 'https://ttraff.cc/pify?keyword=pearson+chemistry+textbook+appendix+d+answers', is flagged as a malicious redirector. The document body also contains this URL, suggesting an attempt to disguise malicious activity as a search result for educational content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=pearson+chemistry+textbook+appendix+d+answers
- http://vopele.mfinlayson.net/uploads/1/3/1/4/131482975/3518153.pdf
- http://files.revolutiontoursinc.com/uploads/1/3/0/8/130813757/0bcf6d9f55.pdf
- https://cdn.shopify.com/s/files/1/0431/9015/7473/files/tovonerug.pdf
- https://cdn.shopify.com/s/files/1/0431/5008/2202/files/82182332129.pdf
- https://cdn.shopify.com/s/files/1/0431/1043/2929/files/free_sheet_music_christmas_carols_satb.pdf
- https://cdn.shopify.com/s/files/1/0438/1586/2434/files/givibidaleluguf.pdf
- https://cdn.shopify.com/s/files/1/0430/8339/9321/files/38870954512.pdf
- https://cdn.shopify.com/s/files/1/0429/2270/5055/files/kujatatavuruk.pdf
- https://cdn.shopify.com/s/files/1/0437/8660/0609/files/84362330755.pdf
- https://cdn.shopify.com/s/files/1/0431/0741/8273/files/livro_de_agrometeorologia.pdf
- https://cdn.shopify.com/s/files/1/0434/1946/7943/files/16659306907.pdf
- https://cdn.shopify.com/s/files/1/0440/8901/6472/files/spontaneous_abortion.pdf
- https://cdn.shopify.com/s/files/1/0427/9946/4611/files/8509450699.pdf
- https://cdn.shopify.com/s/files/1/0440/0293/4942/files/ragemebuzizifimoxezasinud.pdf
- https://cdn.shopify.com/s/files/1/0432/6473/7433/files/37503758492.pdf
- https://cdn.shopify.com/s/files/1/0431/8163/7794/files/duvedisisube.pdf
- https://cdn.shopify.com/s/files/1/0428/6195/3191/files/correct_plural_form_of_appendix.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0428/6195/3191/files/correct_plural_form_of_a

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000045ae.bin` `3e7261311c68c5ddfd1dfdc1afbd4b88db83f1bb5238efbd2a4cd31a89a98b96`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x45AE	5748 bytes
`font_01_sfnt_off0000591e.bin` `d9d4f216730229ef597f963c5eeea84c110ab3731a3279292bbe610a07fc2e45`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x591E	9340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.