PDF malware analysis — malicious · 23af3c6086ceba6e

MALICIOUS

PDF

38.3 KB Created: 2020-09-01 05:09:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fe4ebe32b42dbc31651fcf51812f62e0 SHA-1: 7cc8fae54f49bb6404800aee6f6f8f377c2e7e09 SHA-256: 23af3c6086ceba6e7ee56f552fb3c912eee04278a6eecb6bae75569f381f2db2

128 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/wix?keyword=crystal+report++for+visual+studio+2008'. This URL is presented within the document body, alongside numerous other links to Shopify-hosted PDFs, suggesting a link farm designed for SEO manipulation or to host malicious content. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=crystal+report++for+visual+studio+2008
- https://cdn.shopify.com/s/files/1/0448/3871/5552/files/atas_practice_test.pdf
- https://cdn.shopify.com/s/files/1/0429/5124/5987/files/tavezagikefesodeku.pdf
- https://cdn.shopify.com/s/files/1/0438/9509/5464/files/85836826062.pdf
- https://cdn.shopify.com/s/files/1/0431/2160/6817/files/18467692587.pdf
- https://cdn.shopify.com/s/files/1/0431/2154/1269/files/58248262672.pdf
- https://cdn.shopify.com/s/files/1/0430/6799/8362/files/58728983585.pdf
- https://cdn.shopify.com/s/files/1/0438/4371/5229/files/bsc_nursing_1st_year_books_download.pdf
- https://cdn.shopify.com/s/files/1/0436/0385/3469/files/brigham_city_movie_parents_guide.pdf
- https://cdn.shopify.com/s/files/1/0436/2344/8736/files/71563917823.pdf
- https://cdn.shopify.com/s/files/1/0435/9972/4702/files/detodezeguwezax.pdf
- https://cdn.shopify.com/s/files/1/0430/0223/2983/files/nesuxe.pdf
- https://static.usrfiles.com/ugd/432b07_58f9b2afc9664b96b1896f3dae1e81de.pdf
- https://static.usrfiles.com/ugd/8a419d_4922aa894efd4a4ba764c46e2d4cde4b.pdf
- https://static.usrfiles.com/ugd/05900a_2089584c2572457a92dd065fc99af260.pdf
- https://static.usrfiles.com/ugd/0d2908_624ef111da534677a2aa16473f0ed8d8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000570a.bin` `fdc750627614ab2ce0a72ef40abe5117394716e6593e5c3ab4d188b4aff5692c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x570A	5568 bytes
`font_01_sfnt_off00006a11.bin` `704f1d8fca1a8cef8656fa56e3643c6f4a7c0ffabfb0e6c1e3a6c71f5dcadf5c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A11	10004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.