PDF malware analysis — malicious · 55c22a1a7dade0c9

MALICIOUS

PDF

55.6 KB Created: 2020-08-29 23:08:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 076bff85dda8cd8940ee15510a51f341 SHA-1: 5b400df1cd3b5d0a87b5d08e519c906dba83ae94 SHA-256: 55c22a1a7dade0c99682c2af66cb5c2f503c6baeb5f8c034fe89ca4eff9fed27

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains a mass external link farm and a malicious redirector link pointing to ttraff.ru. The document body, though heavily obfuscated, contains the same malicious URL. This suggests a lure to a malicious site, likely for phishing or malware distribution. The presence of a 'download button' heuristic further supports the social engineering aspect of this attack.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=skyrim+lucien+mod
- https://static.usrfiles.com/ugd/b8c837_ed426657fc0c469bba22da7019b26597.pdf
- https://static.usrfiles.com/ugd/b8c837_80c2f46db26f48fbb153a3c37a4cb125.pdf
- https://static.usrfiles.com/ugd/c7ef1a_70e9cf55d3e74982b4ed58035a5b7be9.pdf
- https://static.usrfiles.com/ugd/ca32a8_2f893fb303b84b84b6a4f075a45664e4.pdf
- https://static.usrfiles.com/ugd/097bd5_43efed62e6bd4c59a1ec8e56d1f3b91a.pdf
- https://static.usrfiles.com/ugd/4b7290_36bffcb4746840cfa01fcdd9f1df5f3d.pdf
- https://static.usrfiles.com/ugd/b8c837_4cb3ad1242f04be28a2eabfdc0afa6fb.pdf
- https://static.usrfiles.com/ugd/b8c837_9651985c44f0437dbdaa0d365ca0ab8f.pdf
- https://static.usrfiles.com/ugd/b8c837_a6f240838ca84365b428cf9ff385a940.pdf
- https://static.usrfiles.com/ugd/b8c837_a2298079133140999817f0eb7840f75a.pdf
- https://static.usrfiles.com/ugd/b8c837_5275b60d53e04940a0f0ca0851ebc307.pdf
- https://static.usrfiles.com/ugd/b8c837_e63ed30d3bb74fc4b721a7fc51224914.pdf
- https://static.usrfiles.com/ugd/b91566_b9a4964d8a4140d7845ada6d0dbad336.pdf
- https://static.usrfiles.com/ugd/b8c837_88e5ae1a84cb4ed89e333e06beae123e.pdf
- https://static.usrfiles.com/ugd/c0b427_a36d0fdc6b6f435fb47eb7bfc91dbe51.pdf
- https://static.usrfiles.com/ugd/b8c837_c20b638aa6674bffbd0ea5704d0f8d8f.pdf
- https://static.usrfiles.com/ugd/b8c837_26c040140da746da94db7265570021d6.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009c90.bin` `410d6f983d29c8db0604e2a09468be85cda9fd007b2ef9b8217e7f7d61d24517`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9C90	4964 bytes
`font_01_sfnt_off0000ad5b.bin` `62f7bf2f4a35c1c9d833761e73a992725405f8004b9879f0e2da3485520498b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAD5B	10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.