PDF malware analysis — malicious · fd332c346b89bf3d

MALICIOUS

PDF

68.2 KB Created: 2020-08-12 03:50:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 02c3738f183ce302b8b737e519d025d7 SHA-1: 9c201e886a2449209be52eadf9ce1f24f4e44f41 SHA-256: fd332c346b89bf3dc20bab06c0a3c4553f47fe43cb4c083a9ade875abb0dbb9c

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links, including one identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'journal psychology of love pdf' and the malicious URL. This suggests a social engineering attack aiming to trick the user into visiting a malicious site by posing as a legitimate document.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=journal+psychology+of+love+pdf
- http://najibe.theraplatenorfolk.com/uploads/1/3/2/6/132695742/wekidawezos.pdf
- http://files.cobbosseeconteesnowmobileclub.com/uploads/1/3/2/8/132815220/1321642.pdf
- http://files.catsinhalifax.ca/uploads/1/3/2/7/132741764/8909266.pdf
- http://files.theemperor.co.uk/uploads/1/3/1/4/131454316/ropomu_wewevep_medovid_bamiful.pdf
- https://cdn.shopify.com/s/files/1/0432/7912/2587/files/tamar.pdf
- https://cdn.shopify.com/s/files/1/0445/7873/4239/files/power_bodybuilding_routine.pdf
- https://cdn.shopify.com/s/files/1/0433/0107/7142/files/51080913231.pdf
- https://cdn.shopify.com/s/files/1/0432/6080/5280/files/69174354623.pdf
- https://cdn.shopify.com/s/files/1/0434/4152/0805/files/dolukanezugesonarib.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/radeziwiwilajumigetadad.pdf
- https://cdn.shopify.com/s/files/1/0434/9621/0594/files/17645708793.pdf
- https://cdn.shopify.com/s/files/1/0431/0673/0138/files/33661929940.pdf
- https://cdn.shopify.com/s/files/1/0432/2977/3982/files/60778573772.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/58657968950.pdf
- https://cdn.shopify.com/s/files/1/0433/0107/7142/files/49040244272.pdf
- https://cdn.shopify.com/s/files/1/0440/6794/6648/files/laxagawevijur.pdf
- https://cdn.shopify.com/s/files/1/0437/6874/2046/files/bacilos_gram_positivos_esporulados.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bf85.bin` `1d5bfbd75c67e37335758deb04e9c026080a0cff3dc73b5f0170219a8af881d7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBF85	5320 bytes
`font_01_sfnt_off0000d195.bin` `bcf8fae2f40af0d3a240a27876f5a753ddb2966175cb883f55afc10ff3abd456`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD195	10564 bytes
`font_02_sfnt_off0000f57f.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF57F	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.