PDF malware analysis — malicious · 447d58e7ab03c779

MALICIOUS

PDF

34.8 KB Created: 2020-08-31 23:26:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 694f402baec22c85a4075e63707f1103 SHA-1: 5e60361511edc7f4b99a0294c9fe660383d40e9e SHA-256: 447d58e7ab03c7791221c7281a9e530e5258b6f6be1f94c1cfbe8e18ad0234aa

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains numerous embedded links, a technique often used for SEO poisoning or to redirect users to malicious sites. One critical heuristic firing indicates a PDF link to a known malicious redirector, specifically 'ttraff.cc'. The document body, though partially garbled, contains text suggesting it's an answer key for a word game, likely a lure to encourage clicks. The presence of many links to 'static.usrfiles.com' also suggests a link farm, potentially to boost SEO for the malicious redirector.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=seven+little+words+answers+jan+26
- https://static.usrfiles.com/ugd/91e123_4f00f0f41060423da29bed10407ba558.pdf
- https://static.usrfiles.com/ugd/bf650e_84452f8a8fea4f648e1a9f3993cd5363.pdf
- https://static.usrfiles.com/ugd/b8c837_9cb973119c11473c929f99e9e82a0979.pdf
- https://static.usrfiles.com/ugd/09c3c7_83dc8bc669b144ffbed8657eb34093a4.pdf
- https://static.usrfiles.com/ugd/eb4c03_2cb908a14f054f60915912c352b2996a.pdf
- https://static.usrfiles.com/ugd/f80014_71b26ff9203d41a1ab99b086bd52447a.pdf
- https://static.usrfiles.com/ugd/b8c837_d1850561e9a84fc1acdab69ed9269913.pdf
- https://static.usrfiles.com/ugd/bb13a2_2c60d99811bc4831b686d2300fc5db88.pdf
- https://static.usrfiles.com/ugd/b8c837_8074e4e6fb15479d8a3e200b9c09d4bb.pdf
- https://static.usrfiles.com/ugd/764aaa_9862733dc2cb427c8e1732ad81ce35e2.pdf
- https://static.usrfiles.com/ugd/97368a_7c0bd71536f442ceb3b1f5358647cb09.pdf
- https://static.usrfiles.com/ugd/ca9b0a_409e3fc3173b4ed88553a8c921b77af0.pdf
- https://static.usrfiles.com/ugd/82e28d_89eead68a2a24c7f83d04e8f871ddcbf.pdf
- https://static.usrfiles.com/ugd/cc03df_410b5203fccf4eb8aff9e397313a6759.pdf
- https://static.usrfiles.com/ugd/4b874d_e2f910a64cfd493dbca8dc4b4b13ae6e.pdf
- https://static.usrfiles.com/ugd/01e791_29c1c2300523432f84b318aa890c0407.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004912.bin` `5ccfa9b7dbbe11b90c0df1c036f03d3527511ff9128b12e497524b97b68c6c2f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4912	5436 bytes
`font_01_sfnt_off00005bae.bin` `dbb2f9f367c800ebaa5c0a504779692cabde0e65c4f84b00adcb93ea2aa99f3a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5BAE	10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.