PDF malware analysis — malicious · 50fe7a85652f0b52

MALICIOUS

PDF

42.1 KB Created: 2020-09-07 14:16:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66f0272f03984e1c4bf0cb0549d027c4 SHA-1: 50c2611afac3754706ad4d7b278cecd5df04674b SHA-256: 50fe7a85652f0b527c5f4d7c40c95bcfa994d2743108302bf99dd25a3b78cdd8

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.club/wix?keyword=slider+bootstrap+template'. This indicates the document's primary purpose is to redirect the user to a potentially harmful site. The file also exhibits characteristics of a PDF SEO link farm, with numerous embedded links, suggesting an attempt to manipulate search engine results or distribute malicious content through a large number of seemingly benign PDFs. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=slider+bootstrap+template
- https://cdn.shopify.com/s/files/1/0434/8523/3304/files/61694574947.pdf
- https://cdn.shopify.com/s/files/1/0437/6900/4190/files/compliance_policy_guide_665._100.pdf
- https://cdn.shopify.com/s/files/1/0431/6836/6760/files/98328184351.pdf
- https://cdn.shopify.com/s/files/1/0440/0391/7974/files/blues_music_videos_free.pdf
- https://static.usrfiles.com/ugd/ef7b09_0fcad4c4b69f45068e99ac948a17b0f2.pdf
- https://static.usrfiles.com/ugd/a374b9_b749636b13164688883e88b4345c6239.pdf
- https://static.usrfiles.com/ugd/5ea4d5_2e224add18c044998adf9f85385f9e37.pdf
- https://static.usrfiles.com/ugd/fa6f14_d7f4e20f0d4643ddbed97e179ad4f0a5.pdf
- https://static.usrfiles.com/ugd/735189_d7268a1c33cb41e8a0238ed6d0710d34.pdf
- https://static.usrfiles.com/ugd/d017d5_78b5365c0c8446bdb56ff5cc14eb7b30.pdf
- https://static.usrfiles.com/ugd/79cb75_34b3f741336d4185b115df1117539425.pdf
- https://static.usrfiles.com/ugd/b28ae2_91fd955da39148e2894d6bf23eb14c6b.pdf
- https://static.usrfiles.com/ugd/eaf48f_122adaa2aecf4f48a60cbc33b626b19a.pdf
- https://static.usrfiles.com/ugd/eed56f_1500525de2c842a0926127d085cfee30.pdf
- https://static.usrfiles.com/ugd/41f880_a21056f87b1048af8240179cc920d6b8.pdf
- https://static.usrfiles.com/ugd/01bc73_ccf9770048814c69b1145fa4222d625d.pdf
- https://static.usrfiles.com/ugd/a76634_4e1de36a59cc40f59b337061ed207e3a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000067e1.bin` `1344c8e8da58154b1c51100ae0b6bbfd0b725062f2e5f1319e47a95f101d4e27`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x67E1	5348 bytes
`font_01_sfnt_off000079ea.bin` `fde05ea8ab6d5c9f8e991a5759ee6c46d6058c5c4e731ce4a20adf3f22d8d5df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79EA	9952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.