PDF malware analysis — malicious · 3af7367d6f0b67c9

MALICIOUS

PDF

45.2 KB Created: 2020-09-01 09:50:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5e7e4edbec606f1361d26897562c5a59 SHA-1: 1fe3d2d826a3f23c9cf4397c5eb4432e3f238b3b SHA-256: 3af7367d6f0b67c99374a45ccd3a917e0fec4ffaf3e91cda9a5f3a3ab909b14c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a mass of external links, with one prominent link disguised as a search result for 'Android watch best buy canada'. This link, `https://ttraff.cc/wix?keyword=android+watch+best+buy+canada`, points to a known malicious redirector. The document body, though heavily obfuscated, contains this URL and appears to be generated by `wkhtmltopdf`, suggesting a programmatic approach to creating a deceptive document. The presence of numerous links to `static.usrfiles.com` further indicates a link farm strategy.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=android+watch+best+buy+canada
- https://static.usrfiles.com/ugd/b8c837_eeb3b2e7382c4d3a8e6af164e73f8587.pdf
- https://static.usrfiles.com/ugd/5de1df_e92818c7b0e64d3f8f5e0fb9a0ff2816.pdf
- https://static.usrfiles.com/ugd/b8c837_30c2c394a7de43c1b808a586a801eb80.pdf
- https://static.usrfiles.com/ugd/b8c837_a0d5665c94c84289bad72b7396d0bf35.pdf
- https://static.usrfiles.com/ugd/fe83c3_373fb452016843eea54831fa011f3901.pdf
- https://static.usrfiles.com/ugd/a1fb72_230cb8a3a0d1485f9e74357952f3a571.pdf
- https://static.usrfiles.com/ugd/34ec99_978a172064d14665823e18a269d43b96.pdf
- https://static.usrfiles.com/ugd/6df952_927ad9f232414a52977b1343f29ef0d3.pdf
- https://static.usrfiles.com/ugd/e3c460_4f862f2c12b14866b0bd4f01cf88e7ad.pdf
- https://cdn.shopify.com/s/files/1/0430/6888/3098/files/the_architect_s_studio_companion_download.pdf
- https://cdn.shopify.com/s/files/1/0437/9446/4929/files/botania_black_lotus.pdf
- https://static.usrfiles.com/ugd/822ecd_2659bf9914204e078721949aa820f6d6.pdf
- https://static.usrfiles.com/ugd/b8c837_a890250f56a84113a07372589ff5293c.pdf
- https://static.usrfiles.com/ugd/af0aa9_ba700c2e31394eb8883f05616b019a47.pdf
- https://static.usrfiles.com/ugd/58a813_a3957e8cb74b45878a1c52edbe994ece.pdf
- https://static.usrfiles.com/ugd/b8c837_b62db0e587704110abc6e9fc1c96111d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007269.bin` `0110109dc60f1bdd2f7df1b22cc8f4335829da76b1c46783fa9acc3da4563be5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7269	5316 bytes
`font_01_sfnt_off0000848a.bin` `462c6f189c615118d73edce4c41ddec35095cb5331cc4c1d1dcd94c4e7a768c2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x848A	10224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.