PDF malware analysis — malicious · 1d0ccd04e380ff9e

MALICIOUS

PDF

41.3 KB Created: 2020-08-30 08:05:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3e00730585a46ced9a639640af4dbf09 SHA-1: 017c62a2c3b59e229d9845513b303cb8cc6ef9fc SHA-256: 1d0ccd04e380ff9e518f2e226e6b2668c420fe3b5510bf4ff0efa633ee596cef

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF file contains a significant number of embedded links, many of which point to a link farm hosted on static.usrfiles.com. One critical heuristic indicates that the PDF links to known malicious redirector infrastructure via the URL https://ttraff.ru/wix?keyword=driver+navigator+full. This suggests a social engineering attempt to trick users into downloading software, potentially malicious, by disguising the malicious redirector as a legitimate download link. The presence of a 'download button' heuristic further supports this lure.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=driver+navigator+full
- https://static.usrfiles.com/ugd/b58d21_6d4d92c800a04a7d8014f00d21299bcd.pdf
- https://static.usrfiles.com/ugd/b8c837_6488a0cfe728435b831603c2fb947484.pdf
- https://static.usrfiles.com/ugd/b8c837_7965b7021d734b74bcf01906dc02aa5d.pdf
- https://static.usrfiles.com/ugd/0a052f_97dab0b0550648079cde344ed47485a3.pdf
- https://cdn.shopify.com/s/files/1/0432/2564/5211/files/88528988412.pdf
- https://cdn.shopify.com/s/files/1/0438/6321/2192/files/dumejijijuxapab.pdf
- https://cdn.shopify.com/s/files/1/0428/2191/0687/files/bufexopisilikofenivujidu.pdf
- https://cdn.shopify.com/s/files/1/0430/8575/8628/files/gibipewu.pdf
- https://cdn.shopify.com/s/files/1/0435/8563/4463/files/44228419017.pdf
- https://static.usrfiles.com/ugd/b8c837_e6b032325d904897bf9cf1e87d7ac8a1.pdf
- https://static.usrfiles.com/ugd/c3f88d_72e81bb4a14145f7a5b0eff9169e155b.pdf
- https://static.usrfiles.com/ugd/3aee12_fcec643156034dfea9473d2146182a4d.pdf
- https://static.usrfiles.com/ugd/f65518_e9571e704c9846229a8c3085d29f48ea.pdf
- https://cdn.shopify.com/s/files/1/0429/1624/9767/files/aircraft_performance_group_training.pdf
- https://cdn.shopify.com/s/files/1/0460/4218/5892/files/30748982913.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006569.bin` `7d7925e3b7f95c51ee0b45392d6bcf33952ef172b9f462f6686886f3117bc1f0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6569	4816 bytes
`font_01_sfnt_off000075ed.bin` `881beaebfb3b6df7c74db80b9474afc810585647a967f6f96bf6ae81e38f666e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75ED	10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.