PDF malware analysis — malicious · 2c7e8294db7dc452

MALICIOUS

PDF

41.4 KB Created: 2020-09-07 17:49:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 469894bc7678ea9f9d3632a375c40906 SHA-1: 6b49c3c2ba86b2d0992fa3904ae9365845044402 SHA-256: 2c7e8294db7dc45237e8581084792442812f6211188400426cdf96ca640a422f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.me/wix?keyword=aish+balkar+sidhu+punjabi+song'. This URL is presented within the document body, disguised with a song title to entice clicks. The file also exhibits characteristics of a link farm, with numerous external PDF links, suggesting a broader campaign to distribute malicious content. No scripts were extracted, but the primary attack vector appears to be social engineering via a deceptive link.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=aish+balkar+sidhu+punjabi+song
- https://static.usrfiles.com/ugd/0ebc1f_18cff1239a5d45d19b91aa1b44bb0f17.pdf
- https://static.usrfiles.com/ugd/ff2e72_d58e8f40e9c94fcfb49d25d0ac95b4df.pdf
- https://static.usrfiles.com/ugd/eb4c03_ba5966daa9e543bbabce5577ec9d8b7a.pdf
- https://static.usrfiles.com/ugd/79cb75_5bd583cbb0ad462ebef8c9d135a3ec6f.pdf
- https://static.usrfiles.com/ugd/cd1d52_3a54e9f052a140f683b1ef918d1be5ee.pdf
- https://static.usrfiles.com/ugd/205ae4_a1c06d911938478e9645a4b27dbbb378.pdf
- https://static.usrfiles.com/ugd/fb5067_f1cb300fdb244828b427417a5e1dc5f7.pdf
- https://static.usrfiles.com/ugd/95ea6b_5c084284fff440b2ba1c806c040833a7.pdf
- https://cdn.shopify.com/s/files/1/0435/8235/7663/files/physics_formulas_class_9.pdf
- https://cdn.shopify.com/s/files/1/0436/6431/0425/files/blank_adjusted_trial_balance_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0432/5575/9011/files/37617684312.pdf
- https://cdn.shopify.com/s/files/1/0435/7488/6563/files/centurion_gate_motor_manual_programming.pdf
- https://static.usrfiles.com/ugd/2f7815_b718e224697545b69ed4ba7514f24eb7.pdf
- https://static.usrfiles.com/ugd/8b9728_074652da44294dd4a647bd9582d8c90e.pdf
- https://static.usrfiles.com/ugd/5926b4_d2321e13e0ea4d2d8f19fb24a853dfdd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004fcd.bin` `a85094a8e36e0fefa4d33410f3b17abf149660db01e8181abb0922ff5deabed3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4FCD	5488 bytes
`font_01_sfnt_off00006273.bin` `1dd92335393ea3ebce219eaea35e173a8b9700e1c4a31cb5676a2fad6cf6ce55`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6273	2452 bytes
`font_02_sfnt_off00006d05.bin` `9a0be27f96ca259cfdf380b05ca1cfed0b1147f3cbe8a649acf926ac084418ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6D05	13740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.