PDF malware analysis — malicious · 465f1364d1ef6fc2

MALICIOUS

PDF

49.0 KB Created: 2020-08-30 19:16:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 948a413da054b5ae121267cb2e966704 SHA-1: 47fbf7b04ede06fb9aa2bcf07a41c18f40e67d13 SHA-256: 465f1364d1ef6fc29a1b30c85ff7041124907f958ed02e881786a0371dcaa2c4

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/wix?keyword=nasm+cpt+book'. This indicates an attempt to redirect the user to a malicious site. The document body, though heavily obfuscated, also contains this URL and numerous other links hosted on 'static.usrfiles.com', suggesting a link farm or redirection strategy. The overall pattern suggests a lure to a malicious site, likely for phishing or malware distribution.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=nasm+cpt+book
- https://static.usrfiles.com/ugd/913720_9789d7c0637f424b9b68db34b897a8f7.pdf
- https://static.usrfiles.com/ugd/b8c837_2c2ec6d995bc4fd9b56e1b516983341c.pdf
- https://static.usrfiles.com/ugd/9ea9b6_18e4f1dc338f46df994ba63077f490c5.pdf
- https://static.usrfiles.com/ugd/493135_e34e12323b1248feaca239c98e572022.pdf
- https://static.usrfiles.com/ugd/01bc73_94adc0737fe345688187402d3dd5273f.pdf
- https://static.usrfiles.com/ugd/b8c837_5b935660bb4b41b0a56ed5f44f4834f7.pdf
- https://static.usrfiles.com/ugd/d54300_2a34152714644af28ce5ecd4e3d99f3d.pdf
- https://static.usrfiles.com/ugd/253000_d5d18ec86a0247f595e8bb4d3cf9aa7e.pdf
- https://static.usrfiles.com/ugd/b8c837_32473a743d01447bb5e2ad934c3fa5c6.pdf
- https://static.usrfiles.com/ugd/b8c837_4c3926fca7d74a2a99aa658980a2377a.pdf
- https://static.usrfiles.com/ugd/b8c837_48aad82aea9f4dc9ae1c5ac7a2329b86.pdf
- https://static.usrfiles.com/ugd/b8c837_86b3e735cce247c796b4d063db64c3de.pdf
- https://static.usrfiles.com/ugd/91e123_fff5e07831d7434c8bb4b7ea775125c1.pdf
- https://static.usrfiles.com/ugd/b8c837_1036b049c496476fa302a3d9a69dcf2a.pdf
- https://cdn.shopify.com/s/files/1/0432/3265/7575/files/gekag.pdf
- https://cdn.shopify.com/s/files/1/0465/5120/3990/files/89957815637.pdf
- https://cdn.shopify.com/s/files/1/0438/4587/7922/files/94837437324.pdf
- https://cdn.shopify.com/s/files/1/0434/2857/7447/files/grammar_translation_method_disadvantages.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000081ec.bin` `88eedf22ebd1210b6e0cb5a7280f569b767f66918916d3e39cb036f7497c657a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81EC	5124 bytes
`font_01_sfnt_off00009349.bin` `23b4c5e975a05bff8db26a3dc79e29d03f4123383749e0549ba3609b619f9371`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9349	10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.