PDF malware analysis — malicious · 7b7270699de7ba11

MALICIOUS

PDF

43.8 KB Created: 2020-08-31 19:47:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 73e9fced5854e5ef89c5d9597935e45e SHA-1: 3cce78218078829b08080bdc497f74ab0ea2f88b SHA-256: 7b7270699de7ba117a24c5d1703bbb6e4e529b7d045fa209c5a395e9c09cd8bf

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=mirror+screen+android+auto+2018'. It also contains a high-risk heuristic for a remote-support tool lure, indicating the document's content is designed to trick the user into installing or connecting to such tools. The presence of a PDF link farm further suggests an attempt to manipulate search engine results or distribute malicious content. No scripts were extracted from this sample.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Remote-support tool lure high SE_REMOTE_SUPPORT_LURE

Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=mirror+screen+android+auto+2018
- https://cdn.shopify.com/s/files/1/0438/6249/1286/files/73866204950.pdf
- https://cdn.shopify.com/s/files/1/0432/1535/6067/files/credit_card_zip_code.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/4274895189.pdf
- https://cdn.shopify.com/s/files/1/0434/8379/1517/files/37631427101.pdf
- https://static.usrfiles.com/ugd/078c79_6453beb6907a46a4872f2bf86995f005.pdf
- https://static.usrfiles.com/ugd/0a0016_dde5e49590874cc48c3a95f0ec423f14.pdf
- https://static.usrfiles.com/ugd/585b1d_b2547922b290498f800fe4a70b0bfc22.pdf
- https://static.usrfiles.com/ugd/b8c837_dcb5058c29704033828765542c911985.pdf
- https://static.usrfiles.com/ugd/6290de_7fc06790c0a24962af0e7391e31d7913.pdf
- https://static.usrfiles.com/ugd/1cc7e8_b31107c8cc2549f69750a8ad8d729399.pdf
- https://static.usrfiles.com/ugd/469aea_127ddb8e4cdf4c6786a1020f1188d9cd.pdf
- https://static.usrfiles.com/ugd/bf650e_b2b087e3b189476fae43c165b36159ba.pdf
- https://static.usrfiles.com/ugd/0d089b_fe5158d7d5f44cdfa437ea47a2698f7d.pdf
- https://static.usrfiles.com/ugd/4e6dd5_1bfcee1c9e1d432693cb8327d8bf84d6.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000663a.bin` `1c1dfa0c49984dc704e4fe9ad58fbcbe5194c37b631d1c87351e8396ab775360`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x663A	5424 bytes
`font_01_sfnt_off000078c2.bin` `df94c374f15c311897d11b555c2d76cabcf3022c5b0bbe4e780af90cfdb0b552`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78C2	13108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.