PDF malware analysis — malicious · fcbb9291ae641dd9

MALICIOUS

PDF

47.2 KB Created: 2020-08-05 03:23:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 94c6e5c766720d165239a324f9469fef SHA-1: bb33267d2fd5cebcbd47a38f30917c7843fa8910 SHA-256: fcbb9291ae641dd9cea1cc3221d94f91736b37db92895db07175afa80357d05d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one specifically identified as a malicious redirector. The document body, though partially corrupted, contains text suggesting a lure related to "Cinematography lighting tutorials pdf" and includes the malicious URL. This indicates a social engineering attack aiming to redirect users to potentially harmful content. No scripts were extracted, and the family is unknown due to the lack of specific indicators.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=cinematography+lighting+tutorials+pdf
- http://files.reloadman.net/uploads/1/3/1/8/131871501/9768742.pdf
- http://files.mydualschools.com/uploads/1/3/1/3/131380000/9157703.pdf
- http://files.mindfulsoulcenter.com/uploads/1/3/0/8/130813601/jonazopola.pdf
- http://files.southernpressonline.com/uploads/1/3/2/7/132712530/b658a7c9c1.pdf
- http://files.acenursingeducation.com/uploads/1/3/0/7/130775373/deregawagadugeke.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/66048758492.pdf
- https://cdn.shopify.com/s/files/1/0431/6315/6641/files/faux_calligraphy_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0432/1165/3282/files/47102611811.pdf
- https://cdn.shopify.com/s/files/1/0432/2335/1458/files/mesixebazu.pdf
- https://cdn.shopify.com/s/files/1/0431/6872/7194/files/ranugalurerunodix.pdf
- https://cdn.shopify.com/s/files/1/0436/8865/7051/files/bopemupukusazajorod.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nasidobedibugamis.pdf
- https://cdn.shopify.com/s/files/1/0434/3690/0504/files/5845776586.pdf
- https://cdn.shopify.com/s/files/1/0432/4976/2459/files/essentials_of_business_communications_9th_edition.pdf
- https://cdn.shopify.com/s/files/1/0428/9062/5191/files/87285382864.pdf
- https://cdn.shopify.com/s/files/1/0429/3096/2588/files/sazukubopakaxunux.pdf
- https://cdn.shopify.com/s/files/1/0429/3846/6460/files/accounting_ledger_groups.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007a7f.bin` `7b9a370ed7a82003e4e7b72319e494af720648c75c9d87aff4c195e19a850fd4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A7F	5464 bytes
`font_01_sfnt_off00008ceb.bin` `e2a2016b79a3429e646adfa4740bb303f6745b24ded7b1ab6ef6c785ad33d99d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8CEB	10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.