PDF malware analysis — malicious · f9cf36ebeeaa8462

MALICIOUS

PDF

57.2 KB Created: 2020-08-30 01:56:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7d7b3ff44c5129e670eb2ce9e0bad4cb SHA-1: f9fb7baeddb3749003ffd2a16fe9f4241ad690aa SHA-256: f9cf36ebeeaa84623045bd980e5aa1482a96228104cc784b8dba02aab54cd9b5

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm and a specific malicious redirector URL. The document body, though heavily obfuscated, contains the same malicious URL, suggesting it is intended to lure the user into clicking it for a fake song download. The link redirects to known malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=manohara+na+hrudayamune+song+mp3+download
- https://static.usrfi
- https://static.usrfiles.com/ugd/b8c837_350d0a29eb0c4a69bdebba7ef5a12e24.pdf
- https://static.usrfiles.com/ugd/9374a7_f0ebeaffb15f428fa62a9f24856ec3d6.pdf
- https://static.usrfiles.com/ugd/4cf28d_46cfe769295e488da6f9c0744528974f.pdf
- https://static.usrfiles.com/ugd/a2d007_f0bfeab6eb6e4eb8806544b43084a999.pdf
- https://static.usrfiles.com/ugd/39cb9d_3c632f4b0715474790f84b4671de8800.pdf
- https://static.usrfiles.com/ugd/ce77c6_12143fbeb6fd4e078b1e6d0fc8685def.pdf
- https://static.usrfiles.com/ugd/23e9be_a67382b82fda4107ae1c8e34b852d1d3.pdf
- https://static.usrfiles.com/ugd/b8c837_1a9a94e16e1245bf9f198ea971a5db30.pdf
- https://static.usrfiles.com/ugd/74c34a_27abba47482c4579a04019bb2072e21b.pdf
- https://static.usrfiles.com/ugd/a1fb72_6efc879ef4154b889ecb6375afd8bce1.pdf
- https://static.usrfiles.com/ugd/b8c837_fba0567a109a46a6868974efd7aa2b5e.pdf
- https://static.usrfiles.com/ugd/5ad03d_1ad5071b8ebd450aa7ce3a7e8d326bf9.pdf
- https://static.usrfiles.com/ugd/10a4aa_b8b66257e10848e2a40f64d5569c3664.pdf
- https://static.usrfiles.com/ugd/b8c837_09d7ed6d04fc4aa49b9d499d3843d6c3.pdf
- https://static.usrfiles.com/ugd/a1fb72_de15ae6a95ad4115aeaf5da307c3ba43.pdf
- https://static.usrfiles.com/ugd/b8c837_33ed2aa250824ee2b529c83309b153c1.pdf
- https://static.usrfiles.com/ugd/735189_21d448d5424e4acdbe514d5b62ec2569.pdf
- https://static.usrfiles.com/ugd/136d07_2869acae690a475dacefa2793f10b0fb.pdf
- https://static.usrfiles.com/ugd/b8c837_5706dc71ac81497597232a735f013d13.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000984c.bin` `eead164139ec6ede55d737aae0c073c73c6d1aca9283d5f9cae65dc479935b91`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x984C	5736 bytes
`font_01_sfnt_off0000abc2.bin` `50c4804acf42a10a1282827ac1f5066c5a0e31edfaefb5ceacc2d1d56b8ada00`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xABC2	14120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.