PDF malware analysis — malicious · 1c3c76b69361f438

MALICIOUS

PDF

43.2 KB Created: 2020-09-03 08:27:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a4a431e3b7d5276a8b1f27cc39ae0be9 SHA-1: 96d42d7a32b99a7836cb3328e6025558edae04c4 SHA-256: 1c3c76b69361f438414053d6e8bfb87589b6dc78e58d8f9f48bd1f947a3c54f0

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link pointing to ttraff.com, which is used in a lure for "Winrar 64 free for windows 7". The document also contains a high heuristic for a password-protected archive lure, indicating the user is expected to download an encrypted payload. The presence of a link farm heuristic suggests this PDF is part of a larger SEO poisoning campaign. No scripts were extracted from this sample.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=winrar+64+free+for+windows+7
- https://cdn.shopify.com/s/files/1/0430/1435/7145/files/86274492529.pdf
- https://cdn.shopify.com/s/files/1/0428/7207/8499/files/tapirudewizamoge.pdf
- https://cdn.shopify.com/s/files/1/0431/1446/3394/files/cot_bed_mattress_sheets.pdf
- https://cdn.shopify.com/s/files/1/0429/8162/1919/files/zexuravumu.pdf
- https://cdn.shopify.com/s/files/1/0432/8059/7152/files/16335130791.pdf
- https://static.usrfiles.com/ugd/9904c2_dbe95ab8b7544cb08414844b78069a01.pdf
- https://static.usrfiles.com/ugd/44b221_4bb60dfbcf5046cda0db8c5c5fbce35b.pdf
- https://static.usrfiles.com/ugd/e3c460_2f330a59ad3e4cf29bb0f677bcda0222.pdf
- https://static.usrfiles.com/ugd/035627_b81b9a365e164e4f9e3d239aad576f8c.pdf
- https://static.usrfiles.com/ugd/9cfd0a_0feaa041f2544594b1e6cac108dbe0b5.pdf
- https://cdn.shopify.com/s/files/1/0435/9494/0573/files/dasumejibaveduwoximoru.pdf
- https://cdn.shopify.com/s/files/1/0462/3361/6533/files/antique_henderson_tire_changer.pdf
- https://cdn.shopify.com/s/files/1/0431/2583/3884/files/dikakugizakali.pdf
- https://cdn.shopify.com/s/files/1/0462/5996/2007/files/sileruwegelob.pdf
- https://cdn.shopify.com/s/files/1/0429/2280/3366/files/bifazezuziverelonunemofak.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a60.bin` `de146c2eebe856eac4c55cb473a9e1bd1abca8d9f296ac6d18a92ca652397312`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A60	5296 bytes
`font_01_sfnt_off00007c9d.bin` `475c830046f8994acfd5836e75206bfd19ada635e8fb88969c792e0b1565e722`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C9D	10244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.