PDF malware analysis — malicious · 4fae1b471f00e1c9

MALICIOUS

PDF

40.5 KB Created: 2020-09-12 01:13:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6588acb85746d44b1a260b43161b17a6 SHA-1: 171c8b224f441305370ecdb663f01de09987768f SHA-256: 4fae1b471f00e1c9af60530a733a227284c61c92a0bdff0439e50e1f7b8e140b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a significant number of embedded links, forming a link farm. The primary malicious URL, 'https://ttraff.me/pify?keyword=proform+cardio+hiit+trainer+pro+costco', is identified as a redirector to malicious infrastructure. The document's structure and the presence of numerous links suggest an attempt to lure users to potentially harmful websites, likely for phishing or malware delivery.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=proform+cardio+hiit+trainer+pro+costco
- https://static.usrfiles.com/ugd/67e251_6868970298de4a83a37431a22c191021.pdf
- https://static.usrfiles.com/ugd/4c76bf_42df0688f7454688a134d30ce294c654.pdf
- https://static.usrfiles.com/ugd/359e64_70e3b80c27cd4f2f86fffd62b6fd9747.pdf
- https://static.usrfiles.com/ugd/26481d_e06d4162101940309d8a5fccde5854fa.pdf
- https://static.usrfiles.com/ugd/8acad3_099efc40a47b4999ac5bdd20769a9233.pdf
- https://cdn.shopify.com/s/files/1/0432/6621/2003/files/zabop.pdf
- https://cdn.shopify.com/s/files/1/0441/1519/8104/files/english_grammar_rules_chart.pdf
- https://cdn.shopify.com/s/files/1/0430/9850/5377/files/29908023604.pdf
- https://cdn.shopify.com/s/files/1/0437/2011/4344/files/63799268343.pdf
- https://cdn.shopify.com/s/files/1/0462/4488/8730/files/51212675125.pdf
- https://static.usrfiles.com/ugd/3fc21f_f9f630b2e1c0475694ab2ca4960bd7ef.pdf
- https://static.usrfiles.com/ugd/b8c837_d4e60a866d5641c7a107ae86a43722e5.pdf
- https://static.usrfiles.com/ugd/f65518_b045dc5a3e4245ee9d6531b6cdcb328f.pdf
- https://static.usrfiles.com/ugd/2a2e94_c5b954ad1ab34e45939b5b000296d881.pdf
- https://static.usrfiles.com/ugd/98857b_f1a6945964d648079df36902ae450955.pdf
- https://static.usrfiles.com/ugd/99965f_aa31882f2c2b4eb2882abd0126f3e55f.pdf
- https://static.usrfiles.com/ugd/1c90dc_f7ce32c59f2343e6afe88582c5b3c553.pdf
- https://static.usrfiles.com/ugd/221eaa_9568c11225124ba0a2f45cf78d69902f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005c50.bin` `357547b5f05ad23c76f3a7cac7b6d3682186af497929ffffbf6e2f69d669cde3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C50	5364 bytes
`font_01_sfnt_off00006e61.bin` `36bb3602a40790d621b51d8093ff5ccb235ad30cfd8eda1433e0f13b77b4d93f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E61	11924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.