PDF malware analysis — malicious · 322793c60a6b4273

MALICIOUS

PDF

79.7 KB Created: 2020-09-05 22:53:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 738c60ffd277d795a287100c8d14ad9f SHA-1: 7321146828e3d2366217e10d457f4845757d2fb8 SHA-256: 322793c60a6b42737163cf75d72c3969eb4c6d0da57575f9a9b8f9761be5d3d4

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/pify?keyword=transformers+2007+bumblebee+full+movie'. This URL is embedded within the document's body text, which appears to be a lure related to a movie. The file also exhibits characteristics of a link farm, with numerous external PDF links, suggesting a broader campaign to distribute malicious content. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=transformers+2007+bumblebee+full+movie
- https://static.usrfiles.com/ugd/122077_9943ba36e626453daf894c3d5e0cedb0.pdf
- https://static.usrfiles.com/ugd/b222ea_09fc292740974bbba2687de9a268466b.pdf
- https://static.usrfiles.com/ugd/b8c837_1b2ea211f6774780906f6e8b7e9151f7.pdf
- https://static.usrfiles.com/ugd/d8e941_5430aa367035415095b87fbbf1f742ab.pdf
- https://static.usrfiles.com/ugd/9ff9b8_7b17a2f85e494353a3f75a62896548e6.pdf
- https://static.usrfiles.com/ugd/b11f6d_e2abb4bb37b14875bab9ba334f52e15e.pdf
- https://static.usrfiles.com/ugd/98e298_a0c4d8368f20413e806676af5e5b5271.pdf
- https://static.usrfiles.com/ugd/73c254_21ace8ee1c1a447f92740fa8b2d9245d.pdf
- https://cdn.shopify.com/s/files/1/0433/6015/7855/files/48000657539.pdf
- https://cdn.shopify.com/s/files/1/0428/7329/0908/files/46862470386.pdf
- https://cdn.shopify.com/s/files/1/0431/6377/9240/files/rulori.pdf
- https://cdn.shopify.com/s/files/1/0432/0873/6928/files/60544896249.pdf
- https://cdn.shopify.com/s/files/1/0438/4351/8629/files/bubofi.pdf
- https://static.usrfiles.com/ugd/96768c_3dc824ba21ca48d990375e043923b099.pdf
- https://static.usrfiles.com/ugd/4d935e_d561b64be428477f9569141c5c1f26f0.pdf
- https://static.usrfiles.com/ugd/b8c837_42246c1f7e694986bcaaca0ab1f366a2.pdf
- https://static.usrfiles.com/ugd/e643da_c03fa68b1b1a4524a1d51c59a10b86c7.pdf
- https://static.usrfiles.com/ugd/accd1f_3d4b5ec1a5cb4587a30be93dec6f423e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f7c1.bin` `5ac2d3c02b03618fc7bed22d1154a28df1a2a71131b40545d51d432baab38b27`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7C1	5416 bytes
`font_01_sfnt_off00010a18.bin` `44f23883c99869f4b2836468f2534b5bb2a203eaba1b86498e03b56ac3ba57c8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10A18	12008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.