PDF malware analysis — malicious · 2592344e3d96ac3c

MALICIOUS

PDF

35.0 KB Created: 2020-08-30 12:24:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4daf954a3846637b1be77ba30a91a9d1 SHA-1: 1e2a3dce5adfb378ea0791d721485c7ebd654b99 SHA-256: 2592344e3d96ac3c2bea0251e4d43558bdfb038a6ec1daa821e456713f623f09

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to its inclusion of a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. One of the primary links directs to a known malicious redirector infrastructure at ttraff.com. While the document body contains garbled text, the presence of numerous links, including one to a malicious redirector, strongly suggests a phishing or content-distribution attack vector.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=herbolaria+mexicana%253A+enciclopedia+medicinal
- https://static.usrfiles.com/ugd/4b874d_bbc52d9bf0d541b8af4ef68caa041524.pdf
- https://static.usrfiles.com/ugd/07ef24_b75f6f47af7e477d986faff72c473a10.pdf
- https://static.usrfiles.com/ugd/8b2c09_b3852e275da04ce8859ecf4686150122.pdf
- https://static.usrfiles.com/ugd/19103d_e28b99d032174b2fbbe9fa3b8b00dfe9.pdf
- https://cdn.shopify.com/s/files/1/0432/8180/9563/files/76423995999.pdf
- https://cdn.shopify.com/s/files/1/0438/3988/1373/files/dofaxumodas.pdf
- https://cdn.shopify.com/s/files/1/0433/4541/2254/files/wofotabeju.pdf
- https://cdn.shopify.com/s/files/1/0431/2875/0241/files/bexano.pdf
- https://static.usrfiles.com/ugd/20d83a_ed97e730755c453a9b8ae28433e0f770.pdf
- https://static.usrfiles.com/ugd/06497e_d2936bf73b3048a6870de145d101fdfd.pdf
- https://static.usrfiles.com/ugd/78c764_23073db398e641b7945bc14b8379292e.pdf
- https://static.usrfiles.com/ugd/b8c837_f3fe03b5f37441ef8720a6ec74cb2d99.pdf
- https://static.usrfiles.com/ugd/8b2c09_08fc4098c5b944749e3a02a4abecbe8d.pdf
- https://static.usrfiles.com/ugd/dd4472_f866e057e647424fb42eb8cb4b484775.pdf
- https://static.usrfiles.com/ugd/b8c837_c8c9b2be1bce47338e111739fe604b0b.pdf
- https://static.usrfiles.com/ugd/b8c837_927c2bf494ff478d8ebdfe818e39c2e7.pdf
- https://static.usrfiles.com/ugd/b8c837_3462070560c4448b9b6904571638a6a0.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004a01.bin` `9e72d96ea3ba32924c3df2c13ad5337a9fd5a480a03d4751411a733f21061d71`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4A01	5260 bytes
`font_01_sfnt_off00005bc3.bin` `eaa0c09ba5d1de508b45d2bc4be63ca22c1bd71043532e737c954863f48499ef`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5BC3	9856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.