PDF malware analysis — malicious · f74a72889def240a

MALICIOUS

PDF

44.5 KB Created: 2020-08-29 03:14:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d3bd5c5268ecc3722e3b6bb3eda81ce9 SHA-1: 23dafe4b27da9e225952b8c06cdacdeeb2e00ca7 SHA-256: f74a72889def240a2ee80fa55fc2f7917704b8179efd8b7baf42252c6159d315

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF contains a mass external link farm, with one prominent link identified as a malicious redirector. This redirector is associated with the search term 'es file explorer apk pro old version', suggesting a lure for potentially pirated or outdated software. The presence of a visual download button further supports the social engineering aspect of this attack. The document body, though heavily corrupted, contains the malicious URL, reinforcing the attack vector.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=es+file+explorer+apk+pro+old+version
- https://static.usrfiles.com/ugd/b8c837_0cb7a68ba40f40898af76c2d6bd1c429.pdf
- https://static.usrfiles.com/ugd/b8c837_3d192a65639f4be6bef9b19f263080ca.pdf
- https://static.usrfiles.com/ugd/b8c837_07a66f47cd6d43139eb519c32810930a.pdf
- https://cdn.shopify.com/s/files/1/0432/6385/2712/files/guxakofufujefifum.pdf
- https://cdn.shopify.com/s/files/1/0428/5743/1196/files/power_outage_report_dallas.pdf
- https://cdn.shopify.com/s/files/1/0430/3713/0914/files/ritepekexasaradebiletinox.pdf
- https://static.usrfiles.com/ugd/b8c837_b5ce2959be1140ceb0e46b680de0cc8e.pdf
- https://static.usrfiles.com/ugd/b8c837_f191ca419bf448cb9b0ea12e7cecb6fb.pdf
- https://static.usrfiles.com/ugd/b8c837_57a055deee8445489e7134244864cbe1.pdf
- https://static.usrfiles.com/ugd/b8c837_86c9a4350dd940938455b2054075c08f.pdf
- https://static.usrfiles.com/ugd/b8c837_d8ef1cf0359e4496adfba4afcf0b8cd9.pdf
- https://static.usrfiles.com/ugd/b8c837_f17a7107139c4720a0155e6e97f25fed.pdf
- https://static.usrfiles.com/ugd/b8c837_5f19310028e14f2b8cd2f16550b27979.pdf
- https://static.usrfiles.com/ugd/b8c837_17821927c5e34fd98c198a30765cdcdf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006458.bin` `a220a76306f4d2ce3c7617092e82967b13aaaf213afff271ba735f2ab2c91cdf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6458	5184 bytes
`font_01_sfnt_off00007615.bin` `cf26ff0da57a8eeea291c341ece04f99913d15d211bbe45ee3ba8ddf30c5cbaa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7615	14356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.