PDF malware analysis — malicious · 304f70cd8a1d981d

MALICIOUS

PDF

39.4 KB Created: 2020-09-03 21:49:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8ff59c034041b8e9f311a9428093f2ed SHA-1: 57de32e1d1c3ef11aa1c53853a1e6a6791f5eae2 SHA-256: 304f70cd8a1d981d743084f236b998613759cbf3cc53f5b24ff03e45193598df

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. This link, 'https://ttraff.me/pify?keyword=approved+smeda+business+feasibility+report', is designed to lure users into clicking by appearing as a legitimate business report. The PDF also exhibits characteristics of a link farm, with numerous external links, suggesting a broader campaign to distribute malicious content. The primary malicious IOC is the redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=approved+smeda+business+feasibility+report
- https://cdn.shopify.com/s/files/1/0435/0119/1328/files/guluwel.pdf
- https://cdn.shopify.com/s/files/1/0452/2554/1789/files/92025791845.pdf
- https://cdn.shopify.com/s/files/1/0437/3151/7601/files/36170276654.pdf
- https://static.usrfiles.com/ugd/30ea26_74c3275b6f0c4ac4bcf718cabe8fc3a4.pdf
- https://static.usrfiles.com/ugd/ce4b7c_de9126c4a7d54e33b21871c157022f76.pdf
- https://static.usrfiles.com/ugd/1e32c2_050224fcf6ce4224b578a3bf41f2391c.pdf
- https://static.usrfiles.com/ugd/c068f8_2be1602ef6824c34a9efbb103a52a79d.pdf
- https://static.usrfiles.com/ugd/76b6de_b0760f3dd02041b5a9d18c5caee5757c.pdf
- https://static.usrfiles.com/ugd/c162b3_1de2282e09b2443da02cd500666be03d.pdf
- https://static.usrfiles.com/ugd/08fe48_9bce3188ca974e36a0c1b3c6b2ac30b9.pdf
- https://static.usrfiles.com/ugd/ea9bdf_a62cbda154504455a2ca89240f9f7e9b.pdf
- https://static.usrfiles.com/ugd/b7306e_6f57a0d5fad7441a83a798ef7e053e57.pdf
- https://static.usrfiles.com/ugd/d775a9_5605f73714924f8e86e3383f51da7942.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/08fe48_9bce3188ca974e36a0c1b3c6b2ac30b

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005c54.bin` `824423bd4433cd9df4602db38b633a43a65c4a14d2d2c1807ade91cabc538953`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C54	5476 bytes
`font_01_sfnt_off00006ee3.bin` `f2907bd7fc453851c73aef4a2ba8aebb9d983536a182fcb8bdf06e9c41d72e4e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EE3	9904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.