PDF malware analysis — malicious · 1f110f334312436d

MALICIOUS

PDF

42.5 KB Created: 2020-08-01 21:57:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 63eab64c7624687d95ff809b74101a9e SHA-1: ad4a3a51a741f0bf5a85b32bce747e3090ae7497 SHA-256: 1f110f334312436ddd2c79269a01242abd28ea3a71ac9c3ba732837017b718fd

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to a known malicious domain, ttraff.com, which is flagged as a redirector. The document body, though heavily corrupted, contains text related to a 'study guide answers' lure, aligning with the malicious redirector's purpose. The presence of numerous external PDF links, many hosted on Shopify, suggests a link farm or SEO poisoning technique to distribute the malicious lure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=on+cooking+5th+edition+study+guide+answers
- http://files.brianbustosart.com/uploads/1/3/1/3/131383284/najaruveg.pdf
- http://files.cprlifesupport.com/uploads/1/3/2/8/132815872/tujujixetuzafi-kifuba-jisezag-todejoxerusi.pdf
- http://files.gvtrail.com/uploads/1/3/2/6/132681443/fba35caa8b86.pdf
- http://files.mindbuild.org/uploads/1/3/1/0/131071243/ditapoxikawon-kejogenowon.pdf
- http://files.holidaylightingstl.com/uploads/1/3/1/6/131606408/5282606.pdf
- https://cdn.shopify.com/s/files/1/0431/6083/0116/files/xipejeriti.pdf
- https://cdn.shopify.com/s/files/1/0441/3403/9704/files/93097617417.pdf
- https://cdn.shopify.com/s/files/1/0431/2793/1029/files/98602806125.pdf
- https://cdn.shopify.com/s/files/1/0440/0293/4942/files/bixakimiwu.pdf
- https://cdn.shopify.com/s/files/1/0438/7710/5832/files/biridimuzanum.pdf
- https://cdn.shopify.com/s/files/1/0430/7392/9378/files/92773820398.pdf
- https://cdn.shopify.com/s/files/1/0432/1761/7057/files/83893747283.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kerikelamizefebimu.pdf
- https://cdn.shopify.com/s/files/1/0436/5985/3977/files/moduvejaxotaluzowojilevur.pdf
- https://cdn.shopify.com/s/files/1/0430/7540/3929/files/49516913283.pdf
- https://cdn.shopify.com/s/files/1/0431/3461/5706/files/gifibumirerolavib.pdf
- https://cdn.shopify.com/s/files/1/0431/8904/3358/files/wivuxufanokimijo.pdf
- https://cdn.shopify.com/s/files/1/0428/2925/0719/files/10164403499.pdf
- https://cdn.shopify.com/s/files/1/0432/2135/2606/files/11537038644.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064f7.bin` `538bc4e20eb2e2ed1ece190fc8de8d0f5fc097ecc30807655af2f5bc000c2393`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64F7	5576 bytes
`font_01_sfnt_off00007803.bin` `7cb8933d82755e5602dec43d5ad1c5392bcc6ebb29616b9b21914111a26fe169`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7803	10268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.