PDF malware analysis — malicious · 305811faf3f0f0a9

MALICIOUS

PDF

73.2 KB Created: 2020-09-01 22:58:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4f10c82f136848edaffe049d034e33c9 SHA-1: 3666316e5434fd15b8c380c5d3edb23af4bfd1a9 SHA-256: 305811faf3f0f0a92bb771aa3043865f307cfa94ece4a8e67f6d73c8597ab4e1

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a lure related to 'Payu payment gateway integration in android example' and embeds multiple links. One of these links, https://ttraff.com/wix?keyword=payu+payment+gateway+integration+in+android+example, is identified as a known malicious redirector. The document also features a link farm with 22 external PDF links, suggesting an attempt to manipulate search engine results or distribute further malicious content. The presence of urgency and invoice lures further supports a phishing or scamming intent.

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=payu+payment+gateway+integration+in+android+example
- https://static.usrfiles.com/ugd/8cbfce_78560c2fc0f8415bb329b124669e15d7.pdf
- https://static.usrfiles.com/ugd/6846fe_288d029b4be44c7596e8d675a578bea5.pdf
- https://static.usrfiles.com/ugd/d99ef3_6d9b79935a1d4ec4a9599ac633c09a46.pdf
- https://static.usrfiles.com/ugd/b8c837_0666e95256234955a04ebe5362be9d6f.pdf
- https://static.usrfiles.com/ugd/9edd50_71c41a7014414c57a5a614a12bc78297.pdf
- https://static.usrfiles.com/ugd/0ad6c7_a3d9f7c953754ae4954d65e181e557d0.pdf
- https://static.usrfiles.com/ugd/32acb1_1dbdffb1777e4097889b2e0987ce9c46.pdf
- https://static.usrfiles.com/ugd/b8c837_cb8444e3457a4832bae96b7ddb14674a.pdf
- https://static.usrfiles.com/ugd/3ce946_6358246742d74f508df78c79e7544b70.pdf
- https://static.usrfiles.com/ugd/b8c837_3c718861d0aa42f28b8f31c7e3617d2f.pdf
- https://static.usrfiles.com/ugd/0c41e7_0d2a9ce963ef4c49ae18db7b261929e4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc0e.bin` `8d40aa7f70ae36c89233a47dc16c05f301bc1e3104bb2e7da2ff1a66f4f88f61`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC0E	5364 bytes
`font_01_sfnt_off0000ee51.bin` `3439b105c3518ef9c900d5e3ae29f227ab05d5eb2c6dcf19c14e976fbb3f7a36`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE51	12644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.