PDF malware analysis — malicious · 312f4fa09323a840

MALICIOUS

PDF

36.1 KB Created: 2020-08-29 18:57:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5cb6edd479c724b8d1285a44b70cb039 SHA-1: 21489c9e8de84c634f43ca435c7e760e99d95074 SHA-256: 312f4fa09323a8400f981089595958831348dff07533f8b0af838e59831ae0e1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with one identified as a malicious redirector. The heuristic PDF_SEO_LINK_FARM indicates a mass external PDF link farm, suggesting a tactic to broaden reach for malicious purposes. The primary malicious URL identified is https://ttraff.me/wix?keyword=suros+semiologia+la+leo, which likely serves as a lure or initial stage for further malicious activity.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=suros+semiologia+la+leo
- https://static.usrfiles.com/ugd/b8c837_854d07ea873f45c381e7c44f16111951.pdf
- https://static.usrfiles.com/ugd/b8c837_e9a201ea9e9b486cbd7d8926f9c12019.pdf
- https://static.usrfiles.com/ugd/b8c837_2100d23ced5a494985e5751a87342560.pdf
- https://static.usrfiles.com/ugd/b8c837_931b0e9b7100493282f08215d2cce20d.pdf
- https://static.usrfiles.com/ugd/b8c837_b41ed9564edc49e481e31d1d9dac9b30.pdf
- https://static.usrfiles.com/ugd/b8c837_ec97949417784b42addb4dcfc33af21e.pdf
- https://static.usrfiles.com/ugd/77d535_9e3761cac0204754b32084c1d3060483.pdf
- https://static.usrfiles.com/ugd/b8c837_e7dbddfa047848c7ac3f1e2ab88e499b.pdf
- https://static.usrfiles.com/ugd/b8c837_a50c5eb6719045658286e5b0bcf964b7.pdf
- https://static.usrfiles.com/ugd/b8c837_bcdba029e50f433c80ea3aa3731eb84a.pdf
- https://static.usrfiles.com/ugd/1e32c2_4135b7120f05407f8780fa9239508886.pdf
- https://static.usrfiles.com/ugd/b8c837_9f6098a780084613aac26b7d57425968.pdf
- https://static.usrfiles.com/ugd/b8c837_bcc0007b4d3b41fcb9e33fc4eecbbc11.pdf
- https://static.usrfiles.com/ugd/b8c837_847af44f1b3546cfb31964275fee38e1.pdf
- https://static.usrfiles.com/ugd/b8c837_8c5064a05d2f46b4ac596c50e7c9ba93.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004f99.bin` `560d9b62e73199b110b41faf5b856e06eb53f6d56574512a9d6f2f625cfb3267`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4F99	5108 bytes
`font_01_sfnt_off000060da.bin` `403dd9714f75720fce672c1276ad9db05e418f2659d8162eb66bb091c08fd7b0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x60DA	10868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.