PDF malware analysis — malicious · 7f7ddf652aa7ee06

MALICIOUS

PDF

39.0 KB Created: 2020-08-29 18:43:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3a791203791c5f241385e624c0536c00 SHA-1: d12f170cd7e06b5514d9093eb3cb8cd43e07391f SHA-256: 7f7ddf652aa7ee06655cf06e2544dda9034e53bd608f24e0dce1c3f39cd8f1f8

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating a link to known malicious infrastructure. Additionally, PDF_SEO_LINK_FARM indicates a large number of external links, with the primary one being a redirector. The document body contains the URL https://ttraff.cc/wix?keyword=mr+potato+head+five+senses, which is also flagged as malicious. The presence of numerous links, including a malicious redirector, suggests a phishing or social engineering attempt to direct users to harmful content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=mr+potato+head+five+senses
- https://cdn.shopify.com/s/files/1/0427/5165/6102/files/49568581936.pdf
- https://cdn.shopify.com/s/files/1/0429/1058/0902/files/32493560765.pdf
- https://cdn.shopify.com/s/files/1/0435/5257/1555/files/pokod.pdf
- https://static.usrfiles.com/ugd/b8c837_bcdeb140de8b4a1b8d6cfe3dab11a079.pdf
- https://static.usrfiles.com/ugd/b8c837_c9560792eea749edb5500466834619e7.pdf
- https://static.usrfiles.com/ugd/b8c837_997157d551bc4884a913108b97e2cfbe.pdf
- https://static.usrfiles.com/ugd/b8c837_afc8f188e4a548d1bacb7fcad7aeffd4.pdf
- https://static.usrfiles.com/ugd/136d07_06727330b82a43beb2358ecc20c19f22.pdf
- https://cdn.shopify.com/s/files/1/0439/3612/0990/files/bulletproof_diet_download.pdf
- https://cdn.shopify.com/s/files/1/0428/2223/8375/files/befisarogebexigobitu.pdf
- https://cdn.shopify.com/s/files/1/0430/4555/2277/files/36050666796.pdf
- https://cdn.shopify.com/s/files/1/0431/6030/5825/files/94913251754.pdf
- https://cdn.shopify.com/s/files/1/0440/5254/5701/files/4083586074.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kovogosiwe.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/28603075132.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004ee4.bin` `88e13bb95df862ef8f881f2540eebe57ce295900eaa2c617fc049999677aeb4c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4EE4	4952 bytes
`font_01_sfnt_off00005fb5.bin` `d84cd29072486d1eef4db84adf346d167290671411ae4536e58cff61533fab22`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FB5	9804 bytes
`font_02_sfnt_off00008153.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8153	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.