PDF malware analysis — malicious · 271e03d21172dffd

MALICIOUS

PDF

44.1 KB Created: 2020-08-29 13:06:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7f44f908c4ab3435d5f1a84e1dd0e80f SHA-1: a865edae6e5e864cbcfb84515391d5d7ab80d387 SHA-256: 271e03d21172dffdf35026471fc10edc0dd7186c9fb35c8f2657aafb52a15e59

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'https://ttraff.link/wix?keyword=hotel+renaissance+new+orleans'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, many hosted on 'static.usrfiles.com'. The document body, though heavily obfuscated, contains the same malicious redirector URL and a benign-looking PDF URL, suggesting a lure to a malicious site. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=hotel+renaissance+new+orleans
- https://static.usrfiles.com/ugd/b8c837_ab7c7bcb4dd4420a91584ebe5a9a0103.pdf
- https://static.usrfiles.com/ugd/66c878_d1f68360b06444f08ffe9cbb2cc508c6.pdf
- https://static.usrfiles.com/ugd/b8c837_886c79b0d0ea46f991cd3efe39c99d4e.pdf
- https://cdn.shopify.com/s/files/1/0434/0118/3388/files/74026605545.pdf
- https://cdn.shopify.com/s/files/1/0432/4599/4146/files/code_de_l_urbanisme_au_cameroun.pdf
- https://cdn.shopify.com/s/files/1/0432/8921/5129/files/alberto_moravia_roman_tales.pdf
- https://cdn.shopify.com/s/files/1/0438/2566/0066/files/7758951153.pdf
- https://cdn.shopify.com/s/files/1/0429/6255/0940/files/lotumasajifakizatume.pdf
- https://static.usrfiles.com/ugd/b8c837_90b894dfaf584e44b82e71d2bf24d862.pdf
- https://static.usrfiles.com/ugd/b8c837_c9970b5da675482bb4c053a541134968.pdf
- https://static.usrfiles.com/ugd/b8c837_a4c1cb08f05847df90149f31b834ffd9.pdf
- https://static.usrfiles.com/ugd/b8c837_6ca9ee3b85aa4b28a40204dbd0cb6a60.pdf
- https://static.usrfiles.com/ugd/b8c837_b03a392f0c864f339b26f3c3b6d0a86f.pdf
- https://static.usrfiles.com/ugd/b8c837_1314c5e26b3f4a2b8d6559bc7f3751e8.pdf
- https://static.usrfiles.com/ugd/b8c837_19b538f52b314fc4ac84d734c69df4f6.pdf
- https://static.usrfiles.com/ugd/b8c837_cbe46c49a87349c492b1bab2a4e8def3.pdf
- https://static.usrfiles.com/ugd/b8c837_56d54847a64f4655a2ec39c63baa34b4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000686c.bin` `c12baf2602e3ed24e88c2b72e9c50b9bd911d95a632eceb0b56c00d406a254ac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x686C	4848 bytes
`font_01_sfnt_off000078fb.bin` `ccba676845a55befb1875647e98b060d12f813f31ed9f99c35be6a7a3deb0d8c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78FB	13312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.