PDF malware analysis — malicious · 378a71d54964ad11

MALICIOUS

PDF

54.4 KB Created: 2020-08-31 23:42:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 72b594a42e34cb0c03c2886061433d2f SHA-1: 5626eaeef324ab9c900440b295d151cdd0b21127 SHA-256: 378a71d54964ad11205c584b8830e33a65948cb5c8d637898635106b72a9a34e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains the URL 'https://ttraff.ru/wix?keyword=bluetooth+for+pc+windows+7+hp', which is presented as a download for Bluetooth drivers. This suggests a social engineering lure to redirect the user to a malicious site. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=bluetooth+for+pc+windows+7+hp
- https://static.usrfiles.com/ugd/0511f5_930a60f9bcff419494047775f95007bc.pdf
- https://static.usrfiles.com/ugd/b8c837_864f8aa53a194089ae322e85b2b7c595.pdf
- https://static.usrfiles.com/ugd/b8c837_66e615173dc842f485a4b6990aa8b426.pdf
- https://static.usrfiles.com/ugd/8acad3_4d46b9f4c4dd44e7abcda2e46ea00e7a.pdf
- https://static.usrfiles.com/ugd/77d535_344a852cce3243e09ae2ecf1a58e2cf9.pdf
- https://static.usrfiles.com/ugd/b8c837_094845c7814e438ebaa00eb5fd5809b6.pdf
- https://static.usrfiles.com/ugd/432b07_25b3b28864754f6db7b4b33777cbf5a8.pdf
- https://static.usrfiles.com/ugd/b8c837_42f546c2cd7845dba95f46381acebb02.pdf
- https://static.usrfiles.com/ugd/a8ca0f_509e099dae874ccd827a637f78ad1462.pdf
- https://static.usrfiles.com/ugd/c162b3_20f18c82bef7469daf51fe25716bce5b.pdf
- https://static.usrfiles.com/ugd/b8c837_b49899ea6ce24531be5abbcbe765ce65.pdf
- https://static.usrfiles.com/ugd/b8c837_915fbe5ade9346ce8f67f7844ead7270.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000562e.bin` `2bc512397bbfa93ff5315921ea5c39bd88e3b7d228da8e883c4e86656870bcb6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x562E	3572 bytes
`font_01_sfnt_off000062f9.bin` `f54245632c508dfda5d98cb24a29db939025818408b3ad06037ab12f2c84abe8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62F9	5136 bytes
`font_02_sfnt_off0000748b.bin` `5a8d95eaae107312797b0476fd78d0398c79c4ee7ef157866b9cd5fa053aed22`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x748B	15624 bytes
`font_03_sfnt_off0000a50b.bin` `7a7f9af5e8900931be02f5440635d64ed5314144bfc630311abfb5edb1d7fcb6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA50B	16576 bytes
`font_04_sfnt_off0000bbf5.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBBF5	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.