PDF malware analysis — malicious · 4fcc37d711568256

MALICIOUS

PDF

35.7 KB Created: 2020-09-18 10:28:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6112858b5e1bd7e4bf78b03c1e381083 SHA-1: 25c1d95b8d625b0a8d9616ab3534c34f188de0ed SHA-256: 4fcc37d711568256f18788cf0e81982bd724666946ffd8e8614962c9d457027e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to external PDF files, creating a link farm. One of the primary links, 'https://ttraff.me/wix?keyword=van+halen+ringtones+android', is flagged as a malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it's the intended lure. The presence of numerous PDF links and a malicious redirector indicates a phishing or malware distribution attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=van+halen+ringtones+android
- http://garifikas.gnarwhallaby.com/uploads/1/3/0/7/130738531/tibapefeduz.pdf
- http://numipar.whitecaptions.com/uploads/1/3/1/4/131452929/zirigupit.pdf
- http://lizivo.jerseygreenroomclub.com/uploads/1/3/0/9/130969465/71da112e7.pdf
- http://files.helpingthoseleftbehind.com/uploads/1/3/1/6/131607565/pelawebife.pdf
- http://gigilenis.nema-problema.com/uploads/1/3/2/3/132303195/lejukit.pdf
- http://files.foragesomerset.co.uk/uploads/1/3/1/3/131383665/032adbf8f413a04.pdf
- http://files.ptti.org/uploads/1/3/2/6/132695569/0f79de8284.pdf
- https://00c249a5-d5a0-4f3f-933d-7de86474f32f.filesusr.com/ugd/95bb70_ade7c9cd6b5147039d8d4ea5a33d32fb.pdf?index=true
- https://7f576ee7-d519-4847-a830-80abe5cab13f.filesusr.com/ugd/8c0e65_23cb61b6a8704c4784766a34cf7f4671.pdf?index=true
- https://430a6576-7ca3-4cb8-b372-59b9996aa759.filesusr.com/ugd/76aeb6_683fa6a33eae49119613a6b2331be973.pdf?index=true
- https://a00f7b6e-fd69-4d61-94c8-71172d3d3658.filesusr.com/ugd/733c1f_84b22c156e1d4c3daccd270245c23127.pdf?index=true
- https://4f517105-3dc8-4484-8230-977565b33ee3.filesusr.com/ugd/f4de5e_2d15b4220a4848cb874c0d75f73e2778.pdf?index=true
- https://79ba474b-7d39-445d-b3c1-9aa6a86e0296.filesusr.com/ugd/a51aec_a947e9d1088e4a8eb11b7b319528de0e.pdf?index=true
- https://295aa131-1bd3-4d1c-bb9c-8347faf275e1.filesusr.com/ugd/3a38e0_c10ffdf7752c478aa0e9e8d2afc25fb3.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004e05.bin` `1a4e08a3dc9fa150f4c090224a56deadd4b5a634c45c33c14d67e62eba1e0796`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4E05	5052 bytes
`font_01_sfnt_off00005f2e.bin` `e8e61d3c40769717e90f69f8eaf7f0a35d868b10e677d6a74d51263a37616c6a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F2E	10236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.