PDF malware analysis — malicious · 2ce6f8317f5a6a96

MALICIOUS

PDF

46.4 KB Created: 2020-08-29 07:16:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 953b1336064b1ef5a1ef52e34f3ceb2b SHA-1: f2eb79d4ea13bae3b2766d53e2527ab256433b65 SHA-256: 2ce6f8317f5a6a96cd4dce1f0bb9f154c381a56e55524953db254b16af2b24c7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.ru' with a 'larry burkett book' keyword. This indicates a social engineering lure. The document body, though heavily obfuscated, also contains the same URL, reinforcing its role as the primary lure. The file also exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF documents, likely to manipulate search engine results or distribute further content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=larry+burkett+book
- https://static.usrfiles.com/ugd/b8c837_618008f2ae2d4612b1a4364c1bd7a72d.pdf
- https://static.usrfiles.com/ugd/b8c837_78b162e72da3437086b193559b6a6bf9.pdf
- https://static.usrfiles.com/ugd/b8c837_035b3574854243278f78c83ab089b884.pdf
- https://static.usrfiles.com/ugd/b8c837_d22cdb9f5e104815a60ba5cfedbbd167.pdf
- https://static.usrfiles.com/ugd/b8c837_cee671552ef741289eafb298edd3806e.pdf
- https://cdn.shopify.com/s/files/1/0432/3934/2248/files/definition_of_child_development.pdf
- https://cdn.shopify.com/s/files/1/0435/9369/5395/files/cancer_de_prostata_unam.pdf
- https://cdn.shopify.com/s/files/1/0435/1174/2628/files/atopic_dermatitis_diagnostic_criteria.pdf
- https://cdn.shopify.com/s/files/1/0432/7263/4533/files/fifojipujeripatufugenozi.pdf
- https://static.usrfiles.com/ugd/b8c837_84d00b0aba554ca59aefe89adaa1aa86.pdf
- https://static.usrfiles.com/ugd/b8c837_18a89942919b4dd2a945e29a613b3785.pdf
- https://static.usrfiles.com/ugd/b8c837_23de9b25a7244af8b20cabae8e05d6d0.pdf
- https://static.usrfiles.com/ugd/b8c837_04a9ea6336e54b33a7498d49155cc6e9.pdf
- https://static.usrfiles.com/ugd/b8c837_755d6bcfe8554a20be47d4b8f71342da.pdf
- https://static.usrfiles.com/ugd/b8c837_e03fbc2826624aef8dd0d6211dca4743.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006c8e.bin` `7d0c4722435c38c1a363af66a345dc654618e6fcd100970def158beef13e4df2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C8E	4444 bytes
`font_01_sfnt_off00007bca.bin` `d96a5583356629470cb948d716ab7d8737073082120607c999597fc45b4329db`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BCA	10284 bytes
`font_02_sfnt_off00009ef2.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9EF2	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.