PDF malware analysis — malicious · 3507f2e7bd7d1c48

MALICIOUS

PDF

38.9 KB Created: 2020-09-04 14:46:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ef4f1e4158cb22e21c94454209b50f9 SHA-1: 1d7905428063f1ab08e9fe579d0b578148c284ea SHA-256: 3507f2e7bd7d1c48df32e069cb4017fc1dd958893febdfecc8c1a7ada0b18db6

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing indicating it is a malicious redirector link, pointing to 'https://ttraff.link/wix?keyword=mitsubishi+air+conditioning+manual'. The document body, though partially corrupted, contains text suggesting it is a manual, which serves as a lure. The presence of a link farm further supports the malicious intent of redirecting users to potentially harmful content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=mitsubishi+air+conditioning+manual
- https://static.usrfiles.com/ugd/3d514e_c1f6f90f6d224bcf8eab31b6b6de108c.pdf
- https://static.usrfiles.com/ugd/6f7357_8b0564dbb7a84d88a050918e0716e183.pdf
- https://static.usrfiles.com/ugd/a6e5e9_7191d0e7f9314e65b80c50f9288cefa6.pdf
- https://static.usrfiles.com/ugd/e4d7df_5912841c780b407a8ae7e6d5645791f8.pdf
- https://static.usrfiles.com/ugd/b8c837_51590b0c9f604e10b399d1cdb497b411.pdf
- https://cdn.shopify.com/s/files/1/0434/2503/8497/files/25869821977.pdf
- https://cdn.shopify.com/s/files/1/0434/0331/3315/files/enuresis_nocturna_causas.pdf
- https://static.usrfiles.com/ugd/a43ec6_d8fcbca20cf84723aee39e9f752eaa9d.pdf
- https://static.usrfiles.com/ugd/275374_28b5fc4ec1a7455f93ddca61c94d85e7.pdf
- https://static.usrfiles.com/ugd/0adedf_c37c9870ed3a4076adc24983da281652.pdf
- https://static.usrfiles.com/ugd/eda9ba_9562b969325c40138fdd92071c027002.pdf
- https://cdn.shopify.com/s/files/1/0432/0185/5646/files/mamelutokatutu.pdf
- https://cdn.shopify.com/s/files/1/0430/6518/0314/files/business_analysis_and_valuation_using_financial_statements_3rd_edition.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004969.bin` `4c688c0676da4c9c3f1d636d29496b85ed1f90b4285ee9b780884cc7de0e34ac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4969	2960 bytes
`font_01_sfnt_off000053d9.bin` `ead8d6cb3450fb2f8c1b7dd224829a13bb29207477da22e5e99ba435db183f22`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x53D9	5500 bytes
`font_02_sfnt_off00006667.bin` `d942812094f3461238690a567ad0c97d78348c8be6c1642b47fa4bdd1efe7a13`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6667	12696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.