PDF malware analysis — malicious · 3101863614b90eba

MALICIOUS

PDF

66.5 KB Created: 2020-09-01 15:07:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8be32e9fe1836238f51a8bcd80377475 SHA-1: 426e8ae4669b1862e2395cce9fbd2b37393705d9 SHA-256: 3101863614b90ebac6bed989b22dafaf12457d949e2366cc37ecfb69c29f0056

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one specifically identified as a malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://ttraff.club/pify?keyword=bending+stresses+in+beams+pdf', which is likely intended to lure the user to a malicious site. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' confirms this, and 'PDF_SEO_LINK_FARM' indicates a pattern of creating numerous links, likely for SEO manipulation or to distribute malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=bending+stresses+in+beams+pdf
- https://static.usrfiles.com/ugd/d1d005_f083ec6281f34c9fbd15a5a010ad6151.pdf
- https://static.usrfiles.com/ugd/26481d_59654d33922c43c6b561cc74ebe6e332.pdf
- https://static.usrfiles.com/ugd/65b209_7cfa04890e4f4835b44d73b8ed386158.pdf
- https://static.usrfiles.com/ugd/f80014_2680633d532b407aa23bd7af568cc049.pdf
- https://static.usrfiles.com/ugd/b8c837_e37f0d60dca64d2186135b4c078352fe.pdf
- https://static.usrfiles.com/ugd/b8c837_2da413f5cc3649dbbd2e5839352d23f0.pdf
- https://static.usrfiles.com/ugd/784815_41a4bdefa15a41b9be1807853a75a110.pdf
- https://static.usrfiles.com/ugd/79cb75_37253857041b41ef8f198bea55d33ff7.pdf
- https://static.usrfiles.com/ugd/51c472_b907f7fa6ced4904a9682ad01a9bde10.pdf
- https://static.usrfiles.com/ugd/b8c837_c3df21f3f5054bd4a00a04d57a071cc7.pdf
- https://static.usrfiles.com/ugd/d902bb_77a81dd0022442fc8ce0f117bc414f15.pdf
- https://static.usrfiles.com/ugd/cc15ef_da99c982101543a88568db38675cd63d.pdf
- https://static.usrfiles.com/ugd/ef7b09_e71c78b2b80d4ac591a3f073e416d726.pdf
- https://static.usrfiles.com/ugd/3eed2b_da23d44252334aef99b6108a51d168d7.pdf
- https://static.usrfiles.com/ugd/b8c837_424092784b1441f19ed5e9047d8dc79f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009de4.bin` `15d592cd883b42632b43cf1b5dfc306627c8c88566f8ce556a68231ea8acfb45`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9DE4	5516 bytes
`font_01_sfnt_off0000b090.bin` `a2a8fef6a005bc8aea931c1b188d18ddf0c552f31d2ffacfe99ee8fb053e98db`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB090	17584 bytes
`font_02_sfnt_off0000e6f0.bin` `65c46fe0b5e5f7348fa8716b69aac047f28f54cd7be9935e9a680fed596a3479`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6F0	16232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.