PDF malware analysis — malicious · 2640ccbf8e505db0

MALICIOUS

PDF

37.2 KB Created: 2020-08-28 21:16:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8e124bf9631007b609202cc0a93f13a5 SHA-1: 67665f7976e924f4a8592c794b3b0559a63b0fc8 SHA-256: 2640ccbf8e505db0d5eb49174bcc5b7916837113df04728e6dc0f3db9711903d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one specifically identified as a malicious redirector. The document body, though partially obfuscated, contains text that appears to be a book title, likely used as a lure. The primary malicious URL, 'https://ttraff.cc/wix?keyword=first+field+guide+to+animal+tracks+of+southern+africa', is the most critical IOC. The file also exhibits characteristics of a link farm, with numerous links pointing to static.usrfiles.com, suggesting an attempt to manipulate search engine results or distribute content through a large number of seemingly benign PDFs.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=first+field+guide+to+animal+tracks+of+southern+africa
- https://static.usrfiles.com/ugd/b8c837_20de3a8b3a7c429c996668ffc80d8e8f.pdf
- https://static.usrfiles.com/ugd/b8c837_57ede5627bd64971b4976289694babe6.pdf
- https://static.usrfiles.com/ugd/b8c837_e00a3a6dbe5044e19e79717ded6e2396.pdf
- https://static.usrfiles.com/ugd/b8c837_b7b30d30360941fc9ee6229c55a5721d.pdf
- https://static.usrfiles.com/ugd/b8c837_40c5fd9c944a481ea9dd43ed29ba0cb3.pdf
- https://static.usrfiles.com/ugd/b8c837_fae9ca00ce134c25baf418245a62528c.pdf
- https://static.usrfiles.com/ugd/b8c837_c692caf4a0a64d8ca1ba09c60602eacc.pdf
- https://static.usrfiles.com/ugd/b8c837_fa4e1d730bb54bb183730743fb3ae968.pdf
- https://static.usrfiles.com/ugd/b8c837_794720be077449388cd86d87b8f395c3.pdf
- https://static.usrfiles.com/ugd/b8c837_2dc5fa4aef0642abb8432000f11f9378.pdf
- https://static.usrfiles.com/ugd/b8c837_3f9da9d239c04b9490fcdb421235720b.pdf
- https://static.usrfiles.com/ugd/b8c837_4e20110fd41f4636b6ca4aa6395a8683.pdf
- https://static.usrfiles.com/ugd/b8c837_f8cb6a49217443a2bd38dc59a5914f8a.pdf
- https://static.usrfiles.com/ugd/b8c837_a52c3384528c42f8ad4560c85f05aa5e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000053d1.bin` `3421f29f5c1f473f68556a03be8295f873056498c98a67c26b43f376c9bb7e51`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x53D1	5452 bytes
`font_01_sfnt_off0000662b.bin` `1753acaf2ade8c1e49d7e0779e381fd3b153f30183fcc55063d274840ba0bea9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x662B	9944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.