PDF malware analysis — malicious · 52703bda57c7a22a

MALICIOUS

PDF

52.4 KB Created: 2020-08-30 17:50:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5988b4a89e8797a8ba6fccf0c630b26f SHA-1: 2df974c2564ba4a09395e55cfb43361616e67c46 SHA-256: 52703bda57c7a22abd292355e66f29a674fb320fa0c7c6d7fa39f0814e7039b0

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing indicating it links to a known malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'Teach like a champion pdf'. The primary IOC is the malicious redirector URL which is likely used to funnel victims to further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=teach+like+a+champion+pdf
- https://static.usrfiles.com/ugd/b8c837_cc5c1ca9c9a94096a5d4d6580337202a.pdf
- https://static.usrfiles.com/ugd/b8c837_a96ba4d53c5d49dcb42b83e3e8453bac.pdf
- https://static.usrfiles.com/ugd/b8c837_3bd8c060f0054c4aaf48efed9692b423.pdf
- https://static.usrfiles.com/ugd/5899d5_c2c033717c3c4f72b5491029dd49f912.pdf
- https://static.usrfiles.com/ugd/b8c837_1c9dc17f58ea457fae53f3754bd9556e.pdf
- https://static.usrfiles.com/ugd/87a178_543af27d2c28496f894b88debc340d6d.pdf
- https://static.usrfiles.com/ugd/e2c6c1_ad0cd77fc162417582fdba029b3591d0.pdf
- https://static.usrfiles.com/ugd/7f16bd_a8ea19ffa20b47b986e0d26556d34b7f.pdf
- https://static.usrfiles.com/ugd/b8c837_737c091a25834ef7bf01ab27edcd084b.pdf
- https://static.usrfiles.com/ugd/b8c837_63fa5c06e79e4155b579388d06b9f5f7.pdf
- https://static.usrfiles.com/ugd/dc98cc_a7a78b3d2f44493091c8f39bfd6096d0.pdf
- https://static.usrfiles.com/ugd/bf650e_e75453b1d06c42dda19ddb3f737a05dd.pdf
- https://static.usrfiles.com/ugd/b8c837_ba2eaa1b68bf47669681f49f3c753994.pdf
- https://static.usrfiles.com/ugd/b8c837_3cae11349c0f48c1aa905d019fc1a3b5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000083b4.bin` `39cd37d9024451d5aa1eb935685ec5369876e9191c09c134ee0e436d1e0c22dd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83B4	5132 bytes
`font_01_sfnt_off00009501.bin` `f31c637376c9808ad8935aeb8da5d5e991fbff0630c28cc3129d242addd1c9f4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9501	2328 bytes
`font_02_sfnt_off00009f65.bin` `50c042b9b7adeb14445f4c9cc8c074baafa27486e7ccce3a23c776f14e3239d7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9F65	11072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.