PDF malware analysis — malicious · 7c16d79e65fa3a88

MALICIOUS

PDF

42.1 KB Created: 2020-08-30 15:48:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7836604ef2c784f52f3e35a4f4494e7f SHA-1: c3b34926947f62c79af1185f6b5d209a465afdc1 SHA-256: 7c16d79e65fa3a88fa127defb94a16eaf09ac014773e7a9def899b308d789e61

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a link farm designed to manipulate search engine results, leading to a malicious redirector. The primary malicious URL identified is https://ttraff.cc/wix?keyword=the+last+lecture+pdf+free+download. The document body contains garbled text and references to 'wkhtmltopdf', suggesting it was programmatically generated to host these links. No scripts were extracted from this sample.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=the+last+lecture+pdf+free+download
- https://static.usrfiles.com/ugd/7ff653_06471c337327493a973b1c021d590a61.pdf
- https://static.usrfiles.com/ugd/50c35f_461280d4415f4b3daef5da02effa7950.pdf
- https://static.usrfiles.com/ugd/87b9a8_e59b2872322b417ca5050fbee3e0c733.pdf
- https://static.usrfiles.com/ugd/b3bc21_53536141b7184d699ad6e6952f5a6f6c.pdf
- https://static.usrfiles.com/ugd/09273f_45fdf7ad9ff64c24821923f684d4fa43.pdf
- https://static.usrfiles.com/ugd/b8c837_546a959a32ee4409940b3e28b5af5737.pdf
- https://static.usrfiles.com/ugd/bae363_a5d2f20ea15247fe906e30c5a6beae3e.pdf
- https://static.usrfiles.com/ugd/7e0eb0_202ffde4e8a0423cab86c73071dbc6ce.pdf
- https://static.usrfiles.com/ugd/5fd5c1_16600135f6f649a6a1eb1b2eab70c4f5.pdf
- https://static.usrfiles.com/ugd/362633_fd2db4759f8247ce80f750e179a533e2.pdf
- https://static.usrfiles.com/ugd/538d67_1a00f4fcc5e541e096330935abaee34b.pdf
- https://static.usrfiles.com/ugd/23e9be_31181af1c0204596960c0a035632ee07.pdf
- https://static.usrfiles.com/ugd/9219f8_d1cc32b639564c9ea7b0abd5c0ec6f16.pdf
- https://static.usrfiles.com/ugd/96768c_dae28e68296a4a11ad535a7d251b09e9.pdf
- https://static.usrfiles.com/ugd/b8c837_a7c462d476e04256a53a9cc320975875.pdf
- https://static.usrfiles.com/ugd/930050_3b0ff08a89fb4093a7f59e02ba2f9ff3.pdf
- https://static.usrfiles.com/ugd/b8c837_5d26706714284b4f9fb624b41232f538.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064e6.bin` `56878bc41ca191a0d0a13909b2a273eb488bdcc88628db7a0a685d82f7ca0eb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64E6	5284 bytes
`font_01_sfnt_off000076e7.bin` `42180149571a8d62f12685a99cf7c1c03144088a7f5c29f4b04ef4ac1c01f274`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x76E7	10700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.