PDF malware analysis — malicious · 3c4fad0acf3ef5de

MALICIOUS

PDF

44.0 KB Created: 2020-08-30 18:23:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7f1af28b94a32d26cf24c3c85e997182 SHA-1: 47b4c3fbdc66af3464e6334f5cdf389a684c0320 SHA-256: 3c4fad0acf3ef5de058bf5facd1dec6efb3ed57cd507bd459aaf7b5dee1a6faa

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure related to comic books, instructing the user to click a link. This link, 'https://ttraff.cc/wix?keyword=the+dc+comics+guide+to+creating+comics', redirects to known malicious infrastructure. The document also contains a large number of links to other PDFs hosted on static.usrfiles.com, suggesting a link farm or SEO poisoning tactic. The presence of a remote support tool lure further indicates a social engineering attempt to gain user interaction.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Remote-support tool lure high SE_REMOTE_SUPPORT_LURE

Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=the+dc+comics+guide+to+creating+comics
- https://static.usrfiles.com/ugd/d43733_6d7b1f75cc2440e0946aa2c390eb1733.pdf
- https://static.usrfiles.com/ugd/b8c837_02aa42f81d644e0993de17950c2cb1a6.pdf
- https://static.usrfiles.com/ugd/de65f7_7028f2796c394b8d90980f6528ee331d.pdf
- https://static.usrfiles.com/ugd/eb4c03_65bfb09677964efa8c8b5aea91de8706.pdf
- https://static.usrfiles.com/ugd/b8c837_f3a5991bec5e4334a69d2fa0767e093f.pdf
- https://static.usrfiles.com/ugd/b8c837_a29c0173d06040b0b845b4705acdf5d5.pdf
- https://static.usrfiles.com/ugd/b8c837_c6c43a1de9d949f5ad10a1b366588b14.pdf
- https://static.usrfiles.com/ugd/b8c837_23ff7ac0614c439492cf69df7c255c09.pdf
- https://cdn.shopify.com/s/files/1/0436/1384/7714/files/kojageboz.pdf
- https://cdn.shopify.com/s/files/1/0463/1022/8128/files/monster_hunter_world_cooking.pdf
- https://cdn.shopify.com/s/files/1/0434/8110/4541/files/xewezalibapad.pdf
- https://cdn.shopify.com/s/files/1/0438/4607/4525/files/just_host_webmail.pdf
- https://cdn.shopify.com/s/files/1/0434/8513/5014/files/basic_civil_engineering_books_free.pdf
- https://cdn.shopify.com/s/files/1/0431/6443/4592/files/42703069092.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006da9.bin` `f9201a3d841e635684cd187900b91cff9b2bd48eb163a4e791f461f2f693efcc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6DA9	5272 bytes
`font_01_sfnt_off00007f6a.bin` `8cce1c0264729c32a9aee547df7bf239252ecb227f7c9eb5a3e5364672b21627`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F6A	10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.