PDF malware analysis — malicious · 4445fda21b6abade

MALICIOUS

PDF

42.9 KB Created: 2020-08-30 01:23:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4c768ea571d2a766ed766275c9b47798 SHA-1: e6b8dd5be8bdd791f21d0c70e9180bd7c159c079 SHA-256: 4445fda21b6abadec10bcbeabc9680a7231e3472166c8f023ef894b4837e6816

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, directing users to 'https://ttraff.club/wix?keyword=360+defence+norwich+ct'. This indicates an attempt to lure the user to a malicious site. The document body is heavily obfuscated but contains the same URL, reinforcing the malicious intent. The file also exhibits characteristics of a PDF link farm, with numerous links pointing to external resources.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=360+defence+norwich+ct
- https://static.usrfiles.com/ugd/b8c837_c951c817625f4eaab032288f870db976.pdf
- https://static.usrfiles.com/ugd/e4ff69_11763041c2214d518edbcf8e05692354.pdf
- https://static.usrfiles.com/ugd/b8c837_cc392fe176fb4a268201b862ed063098.pdf
- https://static.usrfiles.com/ugd/b8c837_cbc1905634db493a8d298520cd1781be.pdf
- https://static.usrfiles.com/ugd/822ecd_9323600ccae042feaad4e0a623e2f30f.pdf
- https://static.usrfiles.com/ugd/ce77c6_a0dee4b9ae01470ca421f419cc5e038d.pdf
- https://static.usrfiles.com/ugd/3826db_712ab4a7550643c295d448e079fca756.pdf
- https://static.usrfiles.com/ugd/b8c837_50199653541b47a692d79a1b27ef0e76.pdf
- https://static.usrfiles.com/ugd/b8c837_4a8e8b88ce3f42ecaa4fc7149577fd9a.pdf
- https://static.usrfiles.com/ugd/7f46b5_d719f046efe24963a5902628e4dfbf44.pdf
- https://static.usrfiles.com/ugd/fa6f14_2f3313c85e9e4f6ab304988b7f110b71.pdf
- https://static.usrfiles.com/ugd/10b11f_93e7565b599a436b90c9c02c72c9fda4.pdf
- https://static.usrfiles.com/ugd/b8c837_0fe6bfb818604b0380d7754413a4b16e.pdf
- https://static.usrfiles.com/ugd/b8c837_4364837c90e34bed80cf35080e482e5a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b8c837_50199653541b47a6

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065af.bin` `a236b09ef29f8fd7b8898108921dc83664655f4ce7c0c2b38387ff400bab5bd2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65AF	5148 bytes
`font_01_sfnt_off0000772f.bin` `5af96795d07dce951c9ba0db18eae0d0484227171fc61329de8ed6c816d0e87a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x772F	12308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.