PDF malware analysis — malicious · fc0a765a28973fbf

MALICIOUS

PDF

69.6 KB Created: 2020-08-20 19:49:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 890abf2cd398d20973a12cd73647156b SHA-1: 67a6ffd50ef8f367c7effb3371acd100daa5cba5 SHA-256: fc0a765a28973fbf349472062b2a080cbee73093f1bed44b78bcc0e614ea720c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with many pointing to a redirector service. This suggests a phishing or social engineering attack where the ultimate goal is to lure the user to a malicious site. The presence of a link farm heuristic further supports this, indicating an attempt to distribute malicious content through numerous URLs. The document body itself is heavily obfuscated and contains the primary redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=terraform+depends_on+module+output
- http://kegil.danielaolszewska.com/uploads/1/3/0/7/130740178/52b2b171d.pdf
- https://cdn.shopify.com/s/files/1/0431/3638/5181/files/ninebezovok.pdf
- https://cdn.shopify.com/s/files/1/0434/7107/7526/files/boat_building_plans.pdf
- https://cdn.shopify.com/s/files/1/0429/9853/0202/files/dudut.pdf
- https://cdn.shopify.com/s/files/1/0431/4431/5029/files/kambi_kathakal_download.pdf
- https://cdn.shopify.com/s/files/1/0448/1040/4000/files/calligraphy_exercises_for_beginners.pdf
- https://cdn.shopify.com/s/files/1/0429/6802/3194/files/79651600454.pdf
- https://cdn.shopify.com/s/files/1/0430/0469/0581/files/oxford_discover_3_writing_and_spelling.pdf
- https://cdn.shopify.com/s/files/1/0429/4747/7667/files/biotecnika_times.pdf
- https://cdn.shopify.com/s/files/1/0434/5567/6580/files/the_academic_phrasebank_free.pdf
- https://cdn.shopify.com/s/files/1/0434/5934/6582/files/amplitude_modulation_and_demodulation_theory.pdf
- https://cdn.shopify.com/s/files/1/0445/9390/5828/files/embriologia_de_la_piel_y_anexos.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b27c.bin` `814780fd4b3e365ed1699b73ca41ca7f95aecf51fc97673813f9f51f2f720f50`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB27C	5000 bytes
`font_01_sfnt_off0000c368.bin` `99ca08574c0f61703d69c95e98248c5d024aef0632fe13605c1c1e389329cf25`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC368	2744 bytes
`font_02_sfnt_off0000cf12.bin` `e894a2105f8d6810556c27502a1509bdba4a8edd8c0458f2a456a39f401e4e63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCF12	13596 bytes
`font_03_sfnt_off0000fad8.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFAD8	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.