PDF malware analysis — malicious · fa7ed7186b6e61fd

MALICIOUS

PDF

54.1 KB Created: 2020-09-18 02:54:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6780c58b7b219f7f15482a4a69b91c5c SHA-1: 008cdf594123e2b3e4209788134f296b21890fa5 SHA-256: fa7ed7186b6e61fd39c9d0e0e834266f7fa81a5bc3dc2f96fb4dcf03d5fa9b52

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to known malicious infrastructure. The document body, though heavily obfuscated, contains a reconstructed URL that matches the malicious redirector. This suggests the document's primary purpose is to redirect the user to a malicious site, likely for phishing or malware distribution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=strong+versus+weak+acids+worksheet+answers+pogil
- https://e9e9682e-ed9d-45ea-8a95-105b5e57c11f.filesusr.com/ugd/3f2390_fc2e34c6d3cf43d4ae4701bc052caf72.pdf?index=true
- https://e0ea0772-8e35-4bc7-b8e3-d66fd10ba6a6.filesusr.com/ugd/d5cf39_d1d7ac8ddcab4d409ca7c48ac87220b5.pdf?index=true
- https://e1b8cc1b-b525-4fd8-bdda-b106c5afca69.filesusr.com/ugd/57c819_d3d2c4f1c5d54c91a97cb1592e6e414d.pdf?index=true
- https://a233e90e-9ffb-4f5d-ad39-488ad94b8060.filesusr.com/ugd/011e4b_5278e99cc75e4d508833ffc7bb2ca9e7.pdf?index=true
- https://bfe68e40-6ded-4dc6-acdc-41c2e8cd3b22.filesusr.com/ugd/d2751c_2fd2e9d7971e45a8b7d3862e35532059.pdf?index=true
- https://cdn.shopify.com/s/files/1/0458/6271/5545/files/bollywood_movies_english_subtitles_free.pdf
- https://cdn.shopify.com/s/files/1/0481/3648/7074/files/59724368595.pdf
- https://cdn.shopify.com/s/files/1/0430/4951/7205/files/kotela.pdf
- https://cdn.shopify.com/s/files/1/0469/9314/6008/files/weather_for_today_22443.pdf
- https://cdn.shopify.com/s/files/1/0439/3975/8235/files/dofaxanovifaloguzusoxuwa.pdf
- https://9e2d41ee-190a-44cf-90ef-a8d074495a0c.filesusr.com/ugd/c8df25_bcde72ce3b0944c6aa74d44e02a1ae80.pdf?index=true
- https://9520a997-2e36-4f39-b3b9-19383905aff6.filesusr.com/ugd/ecd213_ded1e65f3fe947b5899a74828b5f3f61.pdf?index=true
- https://c6969345-885a-4fb2-982b-6a1d9a6bb273.filesusr.com/ugd/575fb0_16e376be82064ac5aa5b9df82b8d53af.pdf?index=true
- https://7b164129-f6a9-499a-b959-b9175927b33f.filesusr.com/ugd/e4ff69_a6ae6aad4ef644bfb288efb8b6232911.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000091e7.bin` `b391a48f9996ee140746d0375a0d7499a8f306a8f1b2b4b75fbb0a0cfe688b54`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x91E7	5656 bytes
`font_01_sfnt_off0000a540.bin` `30e4d3d52f035671d7b4e5dca9ce14225058f975490a7acc963f9f47d4c9f5e9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA540	11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.