PDF malware analysis — malicious · 48819be3a65bd694

MALICIOUS

PDF

65.6 KB Created: 2020-08-22 17:05:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 64239aff2dbee2be2deea20f75c0c3f1 SHA-1: 06eaf9284da9f309a01f450f080ca2c928cf7089 SHA-256: 48819be3a65bd69490f906c605f7a6fe6d1cb79569e0d622af0b9d75e3bcf576

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.001 Malicious Link T1566.002 Spearphishing Link T1059.003 Windows Command Shell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits a PDF link farm heuristic, suggesting an attempt to generate traffic or distribute content through numerous external links. The document body also contains a lure instructing the user to interact with command-line interfaces, indicating a potential attempt to trick the user into executing commands.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=docker+commands+cheat+sheet
- http://gunowe.allied-integral.com/uploads/1/3/0/8/130814328/4692598.pdf
- http://gegedut.peaceonearth1111.com/uploads/1/3/0/7/130740080/zafawizibi.pdf
- http://files.richardsonlegalpllc.com/uploads/1/3/1/3/131384127/6106404.pdf
- http://files.aztralabs.space/uploads/1/3/1/8/131856584/fda8ff2e7.pdf
- https://cdn.shopify.com/s/files/1/0431/0378/1015/files/57715904467.pdf
- https://cdn.shopify.com/s/files/1/0429/3387/8940/files/22978519360.pdf
- https://cdn.shopify.com/s/files/1/0430/9070/6589/files/74026924949.pdf
- https://cdn.shopify.com/s/files/1/0434/2048/3751/files/wekawabalizudukisixupiwa.pdf
- https://cdn.shopify.com/s/files/1/0435/9330/2178/files/afl_finals_fixture_2020_printable.pdf
- https://cdn.shopify.com/s/files/1/0432/7122/5494/files/54961067933.pdf
- https://cdn.shopify.com/s/files/1/0431/1135/0439/files/trayectoria_del_nervio_vago.pdf
- https://cdn.shopify.com/s/files/1/0433/9066/4860/files/88245594542.pdf
- https://cdn.shopify.com/s/files/1/0438/0111/6833/files/rawinavefuwegu.pdf
- https://cdn.shopify.com/s/files/1/0435/7714/7547/files/6496358533.pdf
- https://cdn.shopify.com/s/files/1/0432/3160/8989/files/bronchiectasis_pathophysiology.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b452.bin` `58cdc3cee0e45f7b54d4229912d04dd291e747e063c35c200a7223a9615db7a8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB452	5212 bytes
`font_01_sfnt_off0000c5d6.bin` `c9f40fb0c8c717027cb2dbfadce64143fac3bb986b208155282df18429e33d9e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC5D6	16680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.