PDF malware analysis — malicious · 36ee5def735622fb

MALICIOUS

PDF

57.0 KB Created: 2020-08-31 11:09:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 92ef12adefbd2a7a718d21430e0fed86 SHA-1: 7999d37a75c8aa0cada25f60f5004ba810d9db13 SHA-256: 36ee5def735622fbb9a0eec143c25e46c79ed0ebd65382dec72c9b6c7ed903f3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, characteristic of a link farm. One of these links, 'https://ttraff.com/wix?keyword=oblivion+corrupt+watchman', is identified as a known malicious redirector. The document body, though heavily obfuscated, contains this URL and references to other PDF files hosted on 'static.usrfiles.com'. This suggests a social engineering attempt to lure users to malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=oblivion+corrupt+watchman
- https://static.usrfiles.com/ugd/4dd980_f15a859796bd4aee81f246b137df7090.pdf
- https://static.usrfiles.com/ugd/b8c837_3145514fadbc403c980e1205c7af80c7.pdf
- https://static.usrfiles.com/ugd/b8c837_f09ee20ddcb847f99ea77f51b776e095.pdf
- https://static.usrfiles.com/ugd/b8c837_66d471974631470d906d39d0ad24135d.pdf
- https://static.usrfiles.com/ugd/79e0dc_de29637d05234af686cecf2af8d3246d.pdf
- https://static.usrfiles.com/ugd/bf650e_19f049fad0d04a69a7cb90c55ac5c9ee.pdf
- https://static.usrfiles.com/ugd/227d0f_90b9423e52fe45b6a871629f6fd0d54f.pdf
- https://static.usrfiles.com/ugd/ade4e6_95241b682bcd42c5955815eef969c86d.pdf
- https://static.usrfiles.com/ugd/b8c837_99708c189bd14f61846832929278c864.pdf
- https://cdn.shopify.com/s/files/1/0428/3557/4943/files/94607717308.pdf
- https://cdn.shopify.com/s/files/1/0434/9073/8328/files/21662720639.pdf
- https://cdn.shopify.com/s/files/1/0430/3519/7602/files/fiwazuvunivekozi.pdf
- https://cdn.shopify.com/s/files/1/0460/7918/0964/files/92904136688.pdf
- https://cdn.shopify.com/s/files/1/0437/7539/3944/files/medical_terminology_for_health_professions_8th_edition_free.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009551.bin` `71c26e924fbfa08c36b7f7635fb0d2f4a1715fb5c12b2accc31cccd139641f5e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9551	5080 bytes
`font_01_sfnt_off0000a66d.bin` `61a1fecfc3d30b7315c3e4cd76e8c4bdb04c80e7eb62d7165e61aa326c9ef3f9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA66D	10256 bytes
`font_02_sfnt_off0000c978.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC978	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.