PDF malware analysis — malicious · 38bbb1f74cf59865

MALICIOUS

PDF

51.6 KB Created: 2020-09-06 21:23:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5c1524d22f915ce8ba812730a9d75e44 SHA-1: 1251d035e407596ac9e41dc132b54b0c30ecc46f SHA-256: 38bbb1f74cf59865a209ec4b8f51c7c550676af755b73f81ee226d32d4579064

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.me/wix?keyword=rosenborg+castle+guide'. This URL is presented within the document body, disguised as a guide, to entice users to click it. The file also exhibits characteristics of a link farm, with numerous embedded URLs, many of which point to benign content but serve to obscure the malicious redirector. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=rosenborg+castle+guide
- https://static.usrfiles.com/ugd/575363_2e49d3fe891e4bae868b517a994b5cb9.pdf
- https://static.usrfiles.com/ugd/1cfe37_19bf583d98f045e995f77a8ee3d39d89.pdf
- https://static.usrfiles.com/ugd/62e2c1_9fbef4e203dd4ab3936cc6f0eb2bae98.pdf
- https://static.usrfiles.com/ugd/df73ab_05caefa03d8c48fea362c562f0e78702.pdf
- https://static.usrfiles.com/ugd/a48928_d428db8ebf794428ad3c957a20aa5a56.pdf
- https://static.usrfiles.com/ugd/b81754_d2da84d387f3427386ca836531822b4f.pdf
- https://cdn.shopify.com/s/files/1/0433/1313/5774/files/honeywell_chronotherm_iv_plus_manual_reset.pdf
- https://cdn.shopify.com/s/files/1/0429/2762/0249/files/kebagekomejikuxelorij.pdf
- https://cdn.shopify.com/s/files/1/0432/3305/0779/files/dugitaxapelorit.pdf
- https://cdn.shopify.com/s/files/1/0432/3144/5156/files/jagotomabowesiwol.pdf
- https://cdn.shopify.com/s/files/1/0437/0874/3834/files/80887146264.pdf
- https://cdn.shopify.com/s/files/1/0434/5534/8888/files/59825080197.pdf
- https://cdn.shopify.com/s/files/1/0469/0169/0528/files/punipepuvewozimovodarar.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006387.bin` `ed2451e57e43322335e2ecbc66b7da3a9bdbd0523d50e9a462f9cfc27bc8e2a9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6387	5256 bytes
`font_01_sfnt_off00007574.bin` `b91f3c26f37c28538ed09035cbea6f9221827f1e30b50c452f08cc820bcc167b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7574	3720 bytes
`font_02_sfnt_off000080d7.bin` `ddb36f93b032c572a43a60831a1fa439652d560a0e085ec6279c6db89dfeec97`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x80D7	10036 bytes
`font_03_sfnt_off0000a366.bin` `02fa00f36ee8852250957e376cdf3d619a2ff28eb12169f5ca17822993e838cb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA366	9000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.