PDF malware analysis — malicious · 1c5d8b439c5f77fd

MALICIOUS

PDF

44.2 KB Created: 2020-09-01 19:58:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7da2ce99d5270cec9138edf580763a0a SHA-1: 0bf4f18a126a60005b3eeaebced1832e3df318c3 SHA-256: 1c5d8b439c5f77fdfee1873c29133c69635dc6f51e9cb379a7383f87cae2ad46

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though partially corrupted, contains text related to a 'pitch report' and includes the malicious URL. This suggests the document is designed to trick users into visiting the redirector, likely as part of a phishing or malware distribution scheme. The presence of numerous other links to Shopify and static.usrfiles.com, while labelled benign, indicates a link farm strategy.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=caa+centre+brampton+ontario+pitch+report
- https://cdn.shopify.com/s/files/1/0432/7184/8100/files/37510243722.pdf
- https://cdn.shopify.com/s/files/1/0435/8871/4653/files/18511529253.pdf
- https://cdn.shopify.com/s/files/1/0434/4469/9288/files/mandate_letter_sample.pdf
- https://cdn.shopify.com/s/files/1/0430/8631/5684/files/46546495667.pdf
- https://cdn.shopify.com/s/files/1/0437/7496/7965/files/79751634249.pdf
- https://static.usrfiles.com/ugd/ca32a8_5943712531ae43fb8a65f98cf8ec1173.pdf
- https://static.usrfiles.com/ugd/6924eb_b016c56f91f343c39cd0e85d6f12c803.pdf
- https://static.usrfiles.com/ugd/b8c837_3c858a73eb3447a9b3c756bf73a9a67f.pdf
- https://static.usrfiles.com/ugd/bb13a2_7682362f61ef4d2fa7e9e0301d759f56.pdf
- https://static.usrfiles.com/ugd/b8c837_41ca20bdd69f449092973dcd8338800b.pdf
- https://static.usrfiles.com/ugd/79cb75_1876e35d705642049077fa02e0c1bb8d.pdf
- https://static.usrfiles.com/ugd/b1277d_ffc5145c1a8e48ed9cb118150ef1550a.pdf
- https://static.usrfiles.com/ugd/9ea91e_e3a557df53fb43f48bb95ffd10b01994.pdf
- https://static.usrfiles.com/ugd/8cbfce_93dc69fd734a44bc880a74c7aa49e866.pdf
- https://static.usrfiles.com/ugd/0511f5_f0b3f068ef11410aabcb5ce787c9fd02.pdf
- https://static.usrfiles.com/ugd/06497e_d22e59f072fd4c989c2a3a0fb2a3a37b.pdf
- https://static.usrfiles.com/ugd/79cb75_abd1e67300224310ab5496bdf373d0f6.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006f55.bin` `6a057d204fc49ff6c23477cdfced774560599c215ed7f8f327afba8acaa851f4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F55	5008 bytes
`font_01_sfnt_off0000802a.bin` `0d83b208448437e042f58c13202b588827ce0417ccd51cda9b46f098a1dd4653`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x802A	10364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.