PDF malware analysis — malicious · fd9d10be620e283f

MALICIOUS

PDF

48.0 KB Created: 2020-08-09 00:47:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8bd8635a3cd233957f55c83cdf09832d SHA-1: ad9d18388d7ee72c4a772fe3d6aa63b513f49c58 SHA-256: fd9d10be620e283f89f35dee1adf4c522a2d8f92b7349561cc46284e78d9a121

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it directs users to malicious infrastructure. The embedded URL `https://ttraff.ru/pify?keyword=accounting+journal+entries+examples+pdf` is likely part of a link farm designed to attract clicks. The document body, though heavily obfuscated, contains fragments of the lure text and the malicious URL, reinforcing the social engineering aspect.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=accounting+journal+entries+examples+pdf
- http://files.firstandmainre.com/uploads/1/3/1/8/131871864/pewop.pdf
- http://files.stbernardsnakerun.org/uploads/1/3/1/4/131437515/5dc84.pdf
- http://files.lakefieldbaptistchurch.org/uploads/1/3/0/8/130813985/buxuzojiwa.pdf
- https://cdn.shopify.com/s/files/1/0434/2870/8519/files/kuzepikir.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/56966684837.pdf
- https://cdn.shopify.com/s/files/1/0439/6960/9886/files/1800345045.pdf
- https://cdn.shopify.com/s/files/1/0430/9018/2297/files/wirotesoxijo.pdf
- https://cdn.shopify.com/s/files/1/0430/3772/0733/files/vedek.pdf
- https://cdn.shopify.com/s/files/1/0433/0536/9758/files/24619738882.pdf
- https://cdn.shopify.com/s/files/1/0429/8106/4853/files/wizir.pdf
- https://cdn.shopify.com/s/files/1/0431/7839/3764/files/php_copy_files.pdf
- https://cdn.shopify.com/s/files/1/0434/9358/9142/files/vuxibafikolopovazexos.pdf
- https://cdn.shopify.com/s/files/1/0434/5679/0678/files/nudogidaladimofezo.pdf
- https://cdn.shopify.com/s/files/1/0428/2309/0343/files/sleeper_cell_meaning.pdf
- https://cdn.shopify.com/s/files/1/0433/9721/8460/files/84385142217.pdf
- https://cdn.shopify.com/s/files/1/0433/3328/8088/files/tanavetifavixuwavor.pdf
- https://cdn.shopify.com/s/files/1/0431/6381/2002/files/free_online_to_word_converter_editable_text.pdf
- https://cdn.shopify.com/s/files/1/0431/4189/0208/files/centropomus_undecimalis.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0430

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007ad5.bin` `8074d6c4356bf4d64c79a1509bfd999afcd1bcdb40e51d6d317ea94d69b4f448`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AD5	5608 bytes
`font_01_sfnt_off00008ddf.bin` `67473ed8350689204caa2ead5c4a7db183b0a2263e6a7f75f200102badbd73a9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DDF	10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.