PDF malware analysis — malicious · 3fde35a4da28823e

MALICIOUS

PDF

44.3 KB Created: 2020-08-30 00:56:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: caf1611b5b755614c5e5013e25b98156 SHA-1: c44d813bb712cb1834e2e8b48cf38cedbfbed7fd SHA-256: 3fde35a4da28823ee604f28f68a8c92edb34da49ed4cb1b7fa3b9997d706a336

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=da+baby+baby+on+baby+zip+download'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links to external PDFs, one of which is 'https://static.usrfiles.com/ugd/b8c837_55ccc61bb7a942039f0ba64841579924.pdf'. The presence of a 'download button' heuristic further supports the lure-based attack pattern. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=da+baby+baby+on+baby+zip+download
- https://static.usrfiles.com/ugd/b8c837_55ccc61bb7a942039f0ba64841579924.pdf
- https://static.usrfiles.com/ugd/b8c837_218497b50b594ead968c1459b005b99b.pdf
- https://static.usrfiles.com/ugd/b8c837_05380624090343b5bca55777ce2fa750.pdf
- https://static.usrfiles.com/ugd/b8c837_9fc0f95631f744759b2ac730f477f9fc.pdf
- https://cdn.shopify.com/s/files/1/0460/3923/6767/files/bsc_math_hons_syllabus.pdf
- https://static.usrfiles.com/ugd/b8c837_f54f9318435f4cac88e1bd6d3ad48bfb.pdf
- https://static.usrfiles.com/ugd/93c935_f667f13238b640e7bf96fbaf168f5f3c.pdf
- https://static.usrfiles.com/ugd/ea2f88_b0b3643591bc43e898f8b1ba7974f601.pdf
- https://static.usrfiles.com/ugd/1c8c6c_308f1ee0b07a461c89d7af9014235011.pdf
- https://static.usrfiles.com/ugd/b8c837_fb6451e830434a869b0256e0a060551a.pdf
- https://static.usrfiles.com/ugd/9219f8_227a670623834935bf86822260bdf456.pdf
- https://static.usrfiles.com/ugd/b8c837_4b9cfd60f7b948419ce255b289583e01.pdf
- https://static.usrfiles.com/ugd/b8c837_ccae4a17a7f04627bd4f1000765c3305.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000062f1.bin` `e9314bd2213ef52c3e385bc77dab33efead751fa050edc8651520900f1ba8e06`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62F1	4652 bytes
`font_01_sfnt_off000072d3.bin` `3c57d60ddebcd566315bd8e19db8892d8969fec3cceba823298bc2ca5f766c6f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x72D3	10460 bytes
`font_02_sfnt_off00009669.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9669	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.