PDF malware analysis — malicious · 48dc50f01e2fd104

MALICIOUS

PDF

53.4 KB Created: 2020-08-31 08:11:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 57658ca34cb800fea0e36e936e915c4d SHA-1: a7b3ecc8eac7fb245dc536954a8fafc67adb7e3e SHA-256: 48dc50f01e2fd1044137afc1934d9e06d93312952058102ca504c736106a09d1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.com'. The document body, though partially corrupted, appears to be a list of Spanish adjectives, likely a lure. The embedded URL 'https://ttraff.com/wix?keyword=lista+de+adjetivos+calificativos+en+espanol' is the primary indicator of malicious intent, designed to redirect the user to a harmful site. The file also contains a large number of external PDF links, suggesting a link farm or SEO poisoning attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=lista+de+adjetivos+calificativos+en+espanol
- https://static.usrfiles.com/ugd/4c1554_40f814ca379f4346acb8d2b4fbd62280.pdf
- https://static.usrfiles.com/ugd/89064d_82c2fa59fc7942dda7632b6ab5ffe05f.pdf
- https://static.usrfiles.com/ugd/b8c837_131b139a46394c5aaed18cd7a6a23c7e.pdf
- https://cdn.shopify.com/s/files/1/0431/6259/9583/files/64577874285.pdf
- https://cdn.shopify.com/s/files/1/0436/4229/0336/files/java_static_class.pdf
- https://static.usrfiles.com/ugd/078c79_4f1722e68e7c4dd8bc246e23b14b13c1.pdf
- https://static.usrfiles.com/ugd/26938b_29850552e21249279b982a692d0b0a70.pdf
- https://static.usrfiles.com/ugd/73cb9e_a8ed783c42394312b441283b378b6dc4.pdf
- https://static.usrfiles.com/ugd/b9801a_800a88c2bcc4408792e4e466a50bb7ff.pdf
- https://static.usrfiles.com/ugd/b42fd6_a5e24f8764414e21b3895e5d9acdaa1f.pdf
- https://static.usrfiles.com/ugd/b8c837_95eeb68320074b9591d5225da0a34793.pdf
- https://static.usrfiles.com/ugd/b8c837_e24ce86c8fa04a588c867cc4fe658ea9.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000617b.bin` `2f01463322f52d318dc1df2410572e6f8fe05e2160c77a2dbbfd97888c90a1f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x617B	4916 bytes
`font_01_sfnt_off00007245.bin` `991f7ef292b59849fa1804c361c52a6255426db797fbcab3b5d31d1f34ee76c9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7245	2116 bytes
`font_02_sfnt_off00007bf0.bin` `a6509508a6591cac1df093f4af2061384f827a260ec032edd0379000302cc498`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BF0	11544 bytes
`font_03_sfnt_off0000a160.bin` `c58d7b8932a9fa2919b316f324811411f1bafaf0e31debdebcaf9134aa4db241`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA160	16672 bytes
`font_04_sfnt_off0000b7b2.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB7B2	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.