PDF malware analysis — malicious · 3a7a6c5975f65a58

MALICIOUS

PDF

43.2 KB Created: 2020-08-31 00:52:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 58c64bac3ca4e9d9ae97bb814db0dc23 SHA-1: 3fc895640eb9837a9f3e7ffb96c1a111428b1d67 SHA-256: 3a7a6c5975f65a58a095bf002f360603dc3be22ca776d9c76c7fcf7d5b4b0546

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a link that redirects to a malicious URL, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body text explicitly mentions 'final draft 9 serial number generator', suggesting a lure to entice users to click the malicious link. The PDF_SEO_LINK_FARM heuristic also indicates the presence of numerous external links, further supporting the malicious intent.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=final+draft+9+serial+number+generato
- https://static.usrfiles.com/ugd/cf14a4_15b9aa6ce2bc474fa5e883cfc922a570.pdf
- https://static.usrfiles.com/ugd/b8c837_362ce055998348668a5072dc3eb203d9.pdf
- https://static.usrfiles.com/ugd/724bd4_6c1dfda8b4a14abfa63d0dcfa58294b8.pdf
- https://static.usrfiles.com/ugd/b7ed05_784ee084bf6d4c32965a2cdca27ac600.pdf
- https://cdn.shopify.com/s/files/1/0430/0816/3993/files/91052639060.pdf
- https://cdn.shopify.com/s/files/1/0459/6223/1967/files/55437296821.pdf
- https://cdn.shopify.com/s/files/1/0430/7514/1794/files/51027108163.pdf
- https://cdn.shopify.com/s/files/1/0431/0266/6906/files/35358162611.pdf
- https://static.usrfiles.com/ugd/b8c837_7e6b4f78c61047bbb36f3180580c07c0.pdf
- https://static.usrfiles.com/ugd/1f6d71_24e254cb4fa54cf0abf213cc87ebaf54.pdf
- https://static.usrfiles.com/ugd/b8c837_396b74fddcfa4f3ea21613a5cf13104d.pdf
- https://static.usrfiles.com/ugd/b8c837_0399333a34a74fe2886e000b8b12b952.pdf
- https://static.usrfiles.com/ugd/b972d5_c264fba2d9754872bab91abd436dd920.pdf
- https://static.usrfiles.com/ugd/b8c837_a2321bc5fd6740268309fa9553565b9c.pdf
- https://static.usrfiles.com/ugd/b8c837_fae9ca00ce134c25baf418245a62528c.pdf
- https://static.usrfiles.com/ugd/b8c837_b52de928a3dc467795c003702e94c2be.pdf
- https://static.usrfiles.com/ugd/b8c837_07194948e0f94b1e95d745f6ae29c3ba.pdf
- https://static.usrfiles.com/ugd/df4650_2137772795a44f18bd61034af55fa8ec.pdf
- http://brainfy.blogspot.com/2016/09/final-draft-9-crack-with-serial-key-full.html
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000066ea.bin` `242d082fa5323cef686340e2ba92cd6966519b03b6682d3f08b6452cb366a2c4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66EA	5480 bytes
`font_01_sfnt_off0000796b.bin` `902cccfd2ccf1229bc2dad06131a9cd0567f504617f5ecd1ec6eab0bd557e87e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x796B	11288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.