PDF malware analysis — malicious · 396050b852bc5273

MALICIOUS

PDF

43.6 KB Created: 2020-09-08 00:47:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 860b633cb621f273e300a71953d201b1 SHA-1: ee38ebf2e0e73c68abd8e07683ee486276db4622 SHA-256: 396050b852bc52732861183899945aba2ba90edc37ffc3e60fd2eacc200aead3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically to `https://ttraff.club/wix?keyword=mathbits+algebra+2+practice+test+1+answers`. This indicates a social engineering attempt to lure victims to a potentially harmful site. The PDF itself is generated by wkhtmltopdf, suggesting it was programmatically created to host these links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=mathbits+algebra+2+practice+test+1+answers
- https://static.usrfiles.com/ugd/aff7ca_cc9c8364ecc3468fa584f7e81579d44c.pdf
- https://static.usrfiles.com/ugd/e2c223_8ffbb8332f5141f1ae0401679eaa7233.pdf
- https://static.usrfiles.com/ugd/e3834b_4536f016c5d84732b93d60ad470680ba.pdf
- https://static.usrfiles.com/ugd/a01749_d9bd960287e14af4a25a1bb8d56c1e2d.pdf
- https://static.usrfiles.com/ugd/fd3290_cff554285a55476caf4993f74692690c.pdf
- https://static.usrfiles.com/ugd/80c1db_43d6485016604d35ac4d16db84da2d99.pdf
- https://static.usrfiles.com/ugd/21e6f2_e17355e904ad420baee9ebe78afc989a.pdf
- https://static.usrfiles.com/ugd/8e1900_650484a5cfe249809f70f8ee379d1d3d.pdf
- https://static.usrfiles.com/ugd/b6aaa0_2dbf2fd27bd8457282173e3156c0a094.pdf
- https://cdn.shopify.com/s/files/1/0434/8254/6341/files/zeleku.pdf
- https://cdn.shopify.com/s/files/1/0440/6899/5222/files/28967252665.pdf
- https://cdn.shopify.com/s/files/1/0430/4253/7629/files/xafevuwilanumix.pdf
- https://cdn.shopify.com/s/files/1/0431/5630/8123/files/bopunakaratonesawugifemos.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/50971407729.pdf
- https://static.usrfiles.com/ugd/ee6770_8abf5b49a3d84e32b3f9065fa954ac93.pdf
- https://static.usrfiles.com/ugd/d90490_89139450554b4a5fbfc333d98a5ad8d6.pdf
- https://static.usrfiles.com/ugd/29c71c_4bb57315ea6b45a284eea8fc6cc2d5b3.pdf
- https://static.usrfiles.com/ugd/b8c837_17a176ca866e4eb795c9ec8c5114e4cf.pdf
- https://static.usrfiles.com/ugd/b8c837_cc17681cc45544259d04b49a771b5b28.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000697f.bin` `54f61a199a38ef3e173a4de92500ab8806cc69b2d5cc3f44497bd7bbd18ae8b5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x697F	5616 bytes
`font_01_sfnt_off00007cb7.bin` `3564363cec241eb85e23c941c8d714f2fdda738310572d676814c847f3cad035`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7CB7	10704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.