PDF malware analysis — malicious · 7bb33bc4e6904db2

MALICIOUS

PDF

35.8 KB Created: 2020-08-31 20:51:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 69810e1bfa7d6c56f28df2b8400bed91 SHA-1: 8e1f95a38cbae12fabb9e95666aa820280b50001 SHA-256: 7bb33bc4e6904db24011a5132e628ee78537e6b706b8a40119b32b3da0e6a535

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a large number of embedded links, many of which point to a link farm hosted on static.usrfiles.com. One of these links, https://ttraff.cc/wix?keyword=esma+ucits+guidelines, is identified as a malicious redirector. The document body text, though partially corrupted, contains the phrase "Esma ucits guidelines", suggesting a lure to trick users into clicking the malicious link. The presence of a link farm and a malicious redirector indicates a phishing or credential harvesting attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=esma+ucits+guidelines
- https://cdn.shopify.com/s/files/1/0431/4424/9499/files/gotafefegiz.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/liwisubusamepumiv.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/38664456414.pdf
- https://static.usrfiles.com/ugd/9ea9b6_8152fe009b4244dab5cc0b5a0097c45e.pdf
- https://static.usrfiles.com/ugd/b8c837_580575a57c014bba9314d1ad3098713d.pdf
- https://static.usrfiles.com/ugd/61f964_65cd790c9c43418b9295780e6e6a6f87.pdf
- https://static.usrfiles.com/ugd/912de2_331cb310f5a54665bdb9580f48c54da0.pdf
- https://static.usrfiles.com/ugd/e643da_860d4e220cfc429cb38783e22ffefbdf.pdf
- https://static.usrfiles.com/ugd/5b9a87_adc255d5bf12400584ebded50dad21ba.pdf
- https://static.usrfiles.com/ugd/a44510_e0f704513f1042e5b07ada249a117ae2.pdf
- https://static.usrfiles.com/ugd/d5415a_10c71a76aed848d28b3275d452c6a957.pdf
- https://static.usrfiles.com/ugd/b52961_51a98dff577f40abae68c10eafbf794f.pdf
- https://static.usrfiles.com/ugd/e3ff21_5600eeafeb384078b85d2b33e7efd909.pdf
- https://static.usrfiles.com/ugd/63d3ad_56aaf447844040ca8e46c68321977b47.pdf
- https://static.usrfiles.com/ugd/0f1814_70a5e91a2b34422cb35a01e17937804d.pdf
- https://static.usrfiles.com/ugd/fa32a6_0d0cc4ef070f40ecbccc097c06533ccc.pdf
- https://static.usrfiles.com/ugd/b8c837_92c89f0ed4484e788e34c4f08e9f3aa5.pdf
- https://static.usrfiles.com/ugd/b8c837_66a6cfa2ee224b98bf7f8cd17310c0b4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004f00.bin` `c1e5dc03d643b08ac140ddba273d5798151f95f5a3e7104923433e972b1de4ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4F00	5120 bytes
`font_01_sfnt_off0000605a.bin` `545209838c7fed806565ce75d296d2726eb1e24564400593964652aff1f0494f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x605A	10092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.