PDF malware analysis — malicious · 7fe21f9d6ea0ecd2

MALICIOUS

PDF

43.3 KB Created: 2020-09-02 00:22:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 482cbb374bb8d6b1a1ee88edce2872f1 SHA-1: e9ee02add798ed51665cff0d72c436b387d0ae20 SHA-256: 7fe21f9d6ea0ecd2e9ac456e134c716ed8d811070b2e1cca438bd9def8ca56e8

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a domain associated with a link farm. One prominent link directs to a known malicious redirector. The document body, though heavily obfuscated, appears to contain SEO-related keywords and the malicious URL, suggesting a lure to drive traffic to malicious infrastructure.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=extra+long+twin+bed+sheets+target
- https://static.usrfiles.com/ugd/b8bbd7_78ab54a7bf7c409cbe14a3c1b1a62635.pdf
- https://static.usrfiles.com/ugd/957c7b_9b31c83f736745fa88272c0fa8ad3941.pdf
- https://static.usrfiles.com/ugd/f4de5e_5af3c77f73ba4e3cb1720fa29e1b1561.pdf
- https://static.usrfiles.com/ugd/b8c837_6102768d76804396873798d0d77a7a9f.pdf
- https://static.usrfiles.com/ugd/7ff653_ed231b607892468097e936f8675d7fa1.pdf
- https://static.usrfiles.com/ugd/fe83c3_d39780b6bb084fb7b764da9c775aa641.pdf
- https://static.usrfiles.com/ugd/a48928_69f180b3800f4cac9db87d121923e468.pdf
- https://static.usrfiles.com/ugd/b8c837_d65940cd08084fabbf064b0cba8dda5a.pdf
- https://static.usrfiles.com/ugd/1a89c8_188aeb0e02e14f8ebbecac08b2fbb5e5.pdf
- https://static.usrfiles.com/ugd/1f2646_ee884eb9244648cbaf843475faec9809.pdf
- https://static.usrfiles.com/ugd/3b0c81_5b5c066ea1df46a58e587a19f03ed764.pdf
- https://static.usrfiles.com/ugd/b8c837_175eddbbee2643abaa28acc967ce3714.pdf
- https://static.usrfiles.com/ugd/b41a9a_4916945392824277942199d6a95642c4.pdf
- https://static.usrfiles.com/ugd/0d2908_4a5a3621d23d415890a7fbd8ec3356f8.pdf
- https://static.usrfiles.com/ugd/c3548c_8b9b06cc28a64fc288a2cefaa5ab2ed2.pdf
- https://static.usrfiles.com/ugd/6cabbb_e5b0f216094e4809aaaa21c7cafccd5d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a27.bin` `8ac91c19669a84f21afabbdfce8e606441ea4286b1f94b73852c068f571f8a47`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A27	5344 bytes
`font_01_sfnt_off00007c5d.bin` `7609d130f1c18743080ffe3924e0479282d4e5a6693339fb48596ba389268287`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C5D	10596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.