PDF malware analysis — malicious · 7d67c028a5c769a5

MALICIOUS

PDF

36.9 KB Created: 2020-08-29 15:38:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 86401494e1ad5e2c12cccc0c66f62eef SHA-1: 0ebf9e2b6a4e65f729f7bc15b54c74437e6964df SHA-256: 7d67c028a5c769a50f4de74cd438dd78a4b2693763c0a183b3674a4e4e0b9997

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with a critical heuristic firing for a PDF link farm. One of these links, 'https://ttraff.cc/wix?keyword=twentieth+century+harmony', is flagged as a known malicious redirector. The document body itself is largely unreadable, but the presence of numerous links suggests a tactic to either manipulate SEO or lead users to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=twentieth+century+harmony
- https://static.usrfiles.com/ugd/b8c837_bb1e6880f2654da2884085ebdeb17af9.pdf
- https://static.usrfiles.com/ugd/b8c837_b86c36ca60e9492c9ac620fe6bc4e91a.pdf
- https://static.usrfiles.com/ugd/e3c460_605c7ef60be748e3b818c117e06ef0d7.pdf
- https://cdn.shopify.com/s/files/1/0433/7824/5781/files/zumozedoparaxonulev.pdf
- https://static.usrfiles.com/ugd/cf14a4_c1de8feb60d44a9386d984446726882a.pdf
- https://static.usrfiles.com/ugd/b8c837_831429a911fb4c8d8575bd1f4600c878.pdf
- https://static.usrfiles.com/ugd/b8c837_131aae11a9d54ad39cb1a4ef21c1cdca.pdf
- https://static.usrfiles.com/ugd/b8c837_0708e1db75234968bc8a88477c727e09.pdf
- https://static.usrfiles.com/ugd/b8c837_e564486daba642e488508a319e5cdba4.pdf
- https://static.usrfiles.com/ugd/b8c837_61ee08718d9a46e2807ffa5dddb71cd5.pdf
- https://static.usrfiles.com/ugd/b8c837_babdc4933463447196e67db98e992f05.pdf
- https://static.usrfiles.com/ugd/b8c837_c8cd22d591d64e009cedc85c9e5d6fd6.pdf
- https://static.usrfiles.com/ugd/b8c837_de72f55ec117407cbe967f743b2b15d8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000547e.bin` `71ea12ab266eaa039089ce6d2efa23c06b1b84cf1dbb038b7bfc4dd3d434cf7c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x547E	4972 bytes
`font_01_sfnt_off0000654a.bin` `e8a4d942d8c92879ccd2359e6b52dc0537db31633cd6e4d5242c2dd9f4e84e5f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x654A	10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.