PDF malware analysis — malicious · 512f6b1be9445030

MALICIOUS

PDF

45.1 KB Created: 2020-09-01 10:19:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3fb7e8abea1748b3840be45d77090b61 SHA-1: c6c0537e16aaad55bfcae6b2a2e9cd8944f8e58b SHA-256: 512f6b1be9445030a76f0c7782c9d2fe06ba2cc698f9df58125521ab2bc86479

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains the URL 'https://ttraff.ru/wix?keyword=formattare+chiavetta+usb+protetta+da+scrittura+ubuntu', which is flagged as malicious. Additionally, the PDF is identified as a link farm, with numerous embedded URLs pointing to static.usrfiles.com, one of which is also listed as a potential IOC. The primary attack pattern involves luring the user to click the malicious link.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=formattare+chiavetta+usb+protetta+da+scrittura+ubuntu
- https://static.usrfiles.com/ugd/162fe6_fcd3ab46ae34491fa101918073b6436d.pdf
- https://static.usrfiles.com/ugd/7ff653_6970ce86c63d49ccaaeb5245e8f038d9.pdf
- https://static.usrfiles.com/ugd/9ea9b6_e4125baec68d4251a741685460d6b0a8.pdf
- https://static.usrfiles.com/ugd/5d2cf3_d69bd92be9da430492b91d195d3c670c.pdf
- https://static.usrfiles.com/ugd/a2d007_d63a08c2c39d4b6aa7a61ba403a6c99f.pdf
- https://static.usrfiles.com/ugd/cbe7f7_1df4cf546822457eac54b260897f3d3b.pdf
- https://static.usrfiles.com/ugd/b8c837_c7a1767b0ebf4c67a7d7807bdf1b2781.pdf
- https://static.usrfiles.com/ugd/738632_c21a2da986e34f19aaac1510fe4c67c5.pdf
- https://static.usrfiles.com/ugd/48d9a1_f4f467895f14447497f40fc6729e1df9.pdf
- https://static.usrfiles.com/ugd/f65518_da308af0a5fc441aa712dc0bf155cea2.pdf
- https://static.usrfiles.com/ugd/b8c837_acf7e84155ca4fe594712a62d09d1253.pdf
- https://static.usrfiles.com/ugd/b8c837_a2298079133140999817f0eb7840f75a.pdf
- https://static.usrfiles.com/ugd/87fdc7_e8db4ed40f1947adb3130b179bf691de.pdf
- https://static.usrfiles.com/ugd/696b8a_0bf32b77cf4648478c514fc266c97b40.pdf
- https://cdn.shopify.com/s/files/1/0429/0877/8663/files/50194589119.pdf
- https://cdn.shopify.com/s/files/1/0434/1517/5335/files/serutitoxapabitadiwife.pdf
- https://cdn.shopify.com/s/files/1/0452/5346/0130/files/business_vocabulary_in_use_cambridge.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006f8d.bin` `8d7d616e9df802b541a66255f9f74405101326c342442abd301a4ceec6ad2958`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F8D	5436 bytes
`font_01_sfnt_off000081d8.bin` `8bbd5bd6b1444f68d8991a3460c1c5542b73602b3d33d832119979d2490cd13c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81D8	10924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.