PDF malware analysis — malicious · 52943cdb3d9d972e

MALICIOUS

PDF

47.9 KB Created: 2020-08-29 14:42:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 47352fe44a515e07ceedeea390abc7ea SHA-1: 651957c5f3b88dc6fdfa82ebbba6a5f64ca9e260 SHA-256: 52943cdb3d9d972e9d958d83277ab45c96b8c91ec3f9b1e86236a055952c3427

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to redirect users to a malicious URL, specifically 'https://ttraff.com/wix?keyword=alfred+russel+wallace+biografia+pdf'. This technique is often used to obscure the final malicious destination or to engage in SEO poisoning for phishing purposes. The document body, though heavily obfuscated, also contains this URL and other benign-looking PDF links, reinforcing the lure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=alfred+russel+wallace+biografia+pdf
- https://cdn.shopify.com/s/files/1/0438/0711/3373/files/bakery_business_plan_free.pdf
- https://cdn.shopify.com/s/files/1/0435/8048/9891/files/72953870579.pdf
- https://cdn.shopify.com/s/files/1/0437/0844/8920/files/revoguza.pdf
- https://cdn.shopify.com/s/files/1/0440/4844/9686/files/55053913589.pdf
- https://cdn.shopify.com/s/files/1/0431/8553/7175/files/deadlock_detection_in_os.pdf
- https://static.usrfiles.com/ugd/b8c837_915fbe5ade9346ce8f67f7844ead7270.pdf
- https://static.usrfiles.com/ugd/b8c837_c2c33be4e9054e7ab1484c88756a0f58.pdf
- https://static.usrfiles.com/ugd/accd1f_bf7bb180d89345c7b111379fccd632d0.pdf
- https://static.usrfiles.com/ugd/b8c837_ecca063486524e0cb3f99abcde058261.pdf
- https://static.usrfiles.com/ugd/b8c837_bd1a8274c51f454a8fef573f351975b6.pdf
- https://static.usrfiles.com/ugd/b8c837_ec98312f23d4465883f3d64519f1ab75.pdf
- https://static.usrfiles.com/ugd/b8c837_76da63fc28d34fea971dc01f55b7041f.pdf
- https://static.usrfiles.com/ugd/63d3ad_43859af061d8478bbec50c0f0434ff64.pdf
- https://static.usrfiles.com/ugd/90c678_2ebc23e2086847d98da73aed7794ff00.pdf
- https://static.usrfiles.com/ugd/b8c837_4abf592978054b1da6bc63980d4e3767.pdf
- https://static.usrfiles.com/ugd/affaa6_26685e5a6ca042b084334baee759e995.pdf
- https://static.usrfiles.com/ugd/b8c837_d39e2a1635f048eca7c97ccc15301fde.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b8c837_c2c33be4e9054e7ab1484c

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007663.bin` `a84668d66ece360a4ab3e65d10c7a0059d279357ef043484be3ce8e2ffab6692`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7663	5544 bytes
`font_01_sfnt_off00008950.bin` `a6fc32d28ccedd4106fac639557ce3e3a98d5fd6018850151e65557af51a8d61`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8950	12260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.