PDF malware analysis — malicious · 589e787316929bc9

MALICIOUS

PDF

65.6 KB Created: 2020-08-30 09:28:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e11f42323f837cd40cdb742884c1fa9b SHA-1: 8edd502631be2afb6fdc57a674ed3c686dfe45cd SHA-256: 589e787316929bc92c703fbca988246bcb5e0b060bc471d22957c95cf1f0ee54

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.001 Malicious Link

The PDF contains multiple embedded links, with one identified as a malicious redirector. The heuristic 'SE_MFA_LURE' indicates the document's content is designed to trick users into providing sensitive information, such as one-time codes or MFA approvals. The presence of a link farm further suggests an attempt to distribute malicious content or phish users. The primary malicious URL identified is https://ttraff.ru/wix?keyword=scarlett+2i4+manual+espanhol.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=scarlett+2i4+manual+espanhol
- https://cdn.shopify.com/s/files/1/0436/1800/9251/files/rubugivomidinoda.pdf
- https://cdn.shopify.com/s/files/1/0433/8555/3061/files/lurinovinikipenejul.pdf
- https://cdn.shopify.com/s/files/1/0433/8817/4497/files/50726280336.pdf
- https://static.usrfiles.com/ugd/724fb5_d63636d583d04ef4b9b2e20bc7361520.pdf
- https://static.usrfiles.com/ugd/b910ae_e6185b16a2b1445c8b0d36f54246767b.pdf
- https://static.usrfiles.com/ugd/b8c837_ad64b139ef814e4697fa16b5cca6eaac.pdf
- https://static.usrfiles.com/ugd/0dd040_681598e0b5b843ef868815a723141962.pdf
- https://static.usrfiles.com/ugd/b8c837_50d717412911452c9e850a5bb5fc6dc9.pdf
- https://cdn.shopify.com/s/files/1/0436/2502/1603/files/36336498925.pdf
- https://cdn.shopify.com/s/files/1/0431/6987/4080/files/56284575788.pdf
- https://cdn.shopify.com/s/files/1/0431/1361/1421/files/rolamudolimotevoraxojivur.pdf
- https://cdn.shopify.com/s/files/1/0435/9002/5375/files/jiretadepibadebata.pdf
- https://static.usrfiles.com/ugd/b8c837_46201d8eba5c486faf7cc6226747510c.pdf
- https://static.usrfiles.com/ugd/ceb2e8_f44b322bcaf34d3199fc7e42ee16aef0.pdf
- https://static.usrfiles.com/ugd/4b68be_2024154e755f49ba921d6b3a5cbb98a2.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b7a4.bin` `a390fd4f8d66b616f5f6a97a03f8dca9885e977e95b9d91bea46a659ba054c59`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB7A4	5496 bytes
`font_01_sfnt_off0000ca1f.bin` `974c0269101d034b3761f3d15465c35e75d9b68f549029474dfdfb8798de077c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA1F	15404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.