PDF malware analysis — malicious · 5828df71356423ba

MALICIOUS

PDF

181.2 KB Created: 2020-09-09 21:57:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6db643fd6a3ff3ee8c267e1ebc2ad7f7 SHA-1: f18984808d96a1b537a2898440336297afa7af66 SHA-256: 5828df71356423ba8fd6dfe3bd5f598cf64cedacad9c9e6f645a70bb766aef68

60 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, pointing to a URL that impersonates a user manual for a Bostitch air compressor. The embedded URL in the document body, 'https://ttraff.cc/wb?keyword=bostitch%206%20gallon%20air%20compressor%20user%20manual', is the primary indicator of malicious intent, likely leading to a phishing or malware distribution site.

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wb?keyword=bostitch%206%20gallon%20air%20compressor%20user%20manual
- https://cdn.shopify.com/s/files/1/0431/4637/9426/files/mavipawekobesosuno.pdf
- https://cdn.shopify.com/s/files/1/0428/5480/9756/files/business_project_proposal_sample_for_students.pdf
- https://cdn.shopify.com/s/files/1/0432/4638/7367/files/arbitration_act_file.pdf
- https://cdn.shopify.com/s/files/1/0435/2406/3392/files/58482361413.pdf
- https://static.usrfiles.com/ugd/7a11b0_e7d85d27c1f041f2a314f80a16430529.pdf
- https://static.usrfiles.com/ugd/b8c837_cb33a94129224f33a0713f8beccb0603.pdf
- https://static.usrfiles.com/ugd/b8c837_9f28f964dfbd4c9dbd9f1f6acb0820fe.pdf
- https://static.usrfiles.com/ugd/b1b3ad_7ffb5226df16406abe3c4e698a2fcf35.pdf
- https://static.usrfiles.com/ugd/0047a4_e1878eba8d954004915dcc76054d886a.pdf
- https://static.usrfiles.com/ugd/fafc38_fff5ee1b0d8d4e6c8c38d7402edef9e8.pdf
- https://static.usrfiles.com/ugd/ade4e6_d97bd11b3d6a4d4a882feafc3ad1a7f1.pdf
- https://static.usrfiles.com/ugd/b8c837_f369167a16424859b507f67f9304f693.pdf
- https://static.usrfiles.com/ugd/09273f_adab517854ff42f59b5bc93f0181ba07.pdf
- https://static.usrfiles.com/ugd/b8c837_3eac225cf6a944daa0d7b574701ecceb.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00026038.bin` `ff24752215b666811d4aab32a256e378da287f80525e42e84a63a6314bc1712f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x26038	5432 bytes
`font_01_sfnt_off00027272.bin` `a4c8a1a406e07d35f113a700791258ac561a88da45cc177353aa55e0f053a885`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27272	2300 bytes
`font_02_sfnt_off00027c65.bin` `9ecd2ba8aa7824f298cd1568401bbebccd166d94c1cd2fbe79c9c1212a01d187`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27C65	16772 bytes
`font_03_sfnt_off0002aef8.bin` `b2d7bf71c6277248f1df0933a27bbe7de85f6df1dac0900c4b3dad9f1024e3bc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2AEF8	2216 bytes
`font_04_sfnt_off0002b83c.bin` `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2B83C	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.