PDF malware analysis — malicious · feeef3664577fd8f

MALICIOUS

PDF

34.6 KB Created: 2020-08-10 02:48:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 484512ac6ef08c5b74176eca2265078d SHA-1: 4a0b6f895bb3b227204b295b0a9a96ec9a752c41 SHA-256: feeef3664577fd8f74fa2808148ffcc6edca87b32a7feceb8fdb54bc33f5bc2e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a large number of embedded links, many of which point to external PDF files hosted on Shopify. One critical heuristic indicates that the PDF links to a known malicious redirector infrastructure. The document body, though heavily obfuscated, contains the URL https://ttraff.cc/pify?keyword=cambridge+pet+worksheets+pdf, which is likely intended to lure the user into clicking through to a malicious site. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=cambridge+pet+worksheets+pdf
- http://files.accordingtophillips.com/uploads/1/3/2/6/132695438/tepar_dibatulo_kodunezeweneke_tolom.pdf
- http://files.farsouthcoasthominoidevidence.org/uploads/1/3/1/4/131409508/tavanaxava.pdf
- http://files.debaserrr.com/uploads/1/3/2/6/132695714/2497450.pdf
- https://cdn.shopify.com/s/files/1/0432/8695/4140/files/belevulumagejasesovigo.pdf
- https://cdn.shopify.com/s/files/1/0435/1767/3636/files/mastering_the_market_cycle.pdf
- https://cdn.shopify.com/s/files/1/0430/3729/4754/files/zefitozuz.pdf
- https://cdn.shopify.com/s/files/1/0438/4777/8469/files/61663217382.pdf
- https://cdn.shopify.com/s/files/1/0429/0458/4355/files/roluxa.pdf
- https://cdn.shopify.com/s/files/1/0433/8280/0542/files/95316170156.pdf
- https://cdn.shopify.com/s/files/1/0435/2511/1972/files/xumegenezutimojenozozazu.pdf
- https://cdn.shopify.com/s/files/1/0434/8978/8069/files/xosiwed.pdf
- https://cdn.shopify.com/s/files/1/0434/1543/7468/files/bobiv.pdf
- https://cdn.shopify.com/s/files/1/0427/6515/6508/files/magifinubukol.pdf
- https://cdn.shopify.com/s/files/1/0431/4549/4684/files/21528597501.pdf
- https://cdn.shopify.com/s/files/1/0434/6455/6710/files/9674976849.pdf
- https://cdn.shopify.com/s/files/1/0429/5337/5897/files/90317756738.pdf
- https://cdn.shopify.com/s/files/1/0431/1741/2501/files/mimamad.pdf
- https://cdn.shopify.com/s/files/1/0431/4929/5776/files/20838575974.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000046ba.bin` `4cb5b211918f845c34db361a59f6e413d40780435188c53565855409f8bba1e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46BA	5624 bytes
`font_01_sfnt_off000059ba.bin` `b4e5e96b1ee7be2c4ffccb2602f0213af7a7d6c227a43d75f47b7a6ca3bc846c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x59BA	10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.