PDF malware analysis — malicious · 1d2aee64c1784355

MALICIOUS

PDF

44.3 KB Created: 2020-07-25 23:02:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ea3aacfc2c84bb5fc147f88f26aa9c9 SHA-1: bb9a6456671b005a851a1de457b7754371b76339 SHA-256: 1d2aee64c17843554c98dbf38e479c183c2446453b6a3c32e27be24ed66e413d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. This link, 'https://ttraff.com/pify?keyword=formless+a+user%2527+s+guide', is likely the primary mechanism for delivering a malicious payload or leading the user to a phishing page. The presence of a PDF link farm heuristic further suggests a coordinated effort to distribute malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=formless+a+user%2527+s+guide
- http://files.thebridalmanor.com/uploads/1/3/0/7/130738725/a0737c93.pdf
- http://files.katianailedit.com/uploads/1/3/1/0/131070212/6a751acd.pdf
- http://files.tylerjonesmusician.com/uploads/1/3/2/8/132814544/buzifipomola.pdf
- http://files.calypsorosewellness.net/uploads/1/3/2/7/132741023/5202968.pdf
- https://cdn.shopify.com/s/files/1/0430/7379/8298/files/28851173657.pdf
- https://cdn.shopify.com/s/files/1/0428/8148/2918/files/32457219941.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/6317908028.pdf
- https://cdn.shopify.com/s/files/1/0432/0827/8171/files/jazelu.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/surorut.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zeranosorijajigafa.pdf
- https://cdn.shopify.com/s/files/1/0434/2625/0917/files/6165072820.pdf
- https://cdn.shopify.com/s/files/1/0433/7503/4520/files/46763959724.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/94662163826.pdf
- https://cdn.shopify.com/s/files/1/0431/4087/4408/files/1324201523.pdf
- https://cdn.shopify.com/s/files/1/0432/7846/7222/files/xikidumov.pdf
- https://cdn.shopify.com/s/files/1/0430/4414/3253/files/58872360974.pdf
- https://cdn.shopify.com/s/files/1/0428/4973/0727/files/83051858184.pdf
- https://cdn.shopify.com/s/files/1/0431/5725/8395/files/73843740858.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064ba.bin` `26cd4b7c216739b2855cf77b0882590b680568829e9e0af8426bb36846f61eed`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64BA	3184 bytes
`font_01_sfnt_off0000700f.bin` `644ae913efd80156feb2eaad27ee9c7ba3d1a8db028441821e8d23367aabf8c9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x700F	4828 bytes
`font_02_sfnt_off00008073.bin` `7bcf178827e301777f683b544bb30904b22839c47f92a3c9cbdb3121ac14421f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8073	10340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.