PDF malware analysis — malicious · 8312bf4202463650

MALICIOUS

PDF

43.9 KB Created: 2020-08-31 14:31:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5422056e7e002d6f309324c8b1b20f7c SHA-1: 532eb4237eafd66bdb187cffc1782b462c01013c SHA-256: 8312bf4202463650c4e2e6ab218112e4d98aef3b3503d4481cef51bdd49b8d1a

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains multiple embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains a URL that appears to be part of a lure for educational content. The presence of numerous links to external PDFs, many hosted on static.usrfiles.com, suggests a link farm designed to obscure the ultimate destination. The primary malicious URL is https://ttraff.cc/wix?keyword=gcse+physics+equation+sheet+p1.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=gcse+physics+equation+sheet+p1
- https://static.usrfiles.com/ugd/6cfc61_787bf1f4636c4e8395fc9489fe4d652c.pdf
- https://static.usrfiles.com/ugd/40b9e6_6d20c2d7d34147cf98223bcfcbe47229.pdf
- https://static.usrfiles.com/ugd/963627_e040ef59c6e74cc891108dbec813dda6.pdf
- https://static.usrfiles.com/ugd/f0f215_a6ede16198ad42c388476df9f7bb9a39.pdf
- https://static.usrfiles.com/ugd/d94ae5_bbd259a7bc2e445a80822b0c9de46da3.pdf
- https://static.usrfiles.com/ugd/374ce0_ebb99c44f4cc499eb8cdcad340432221.pdf
- https://static.usrfiles.com/ugd/c33cdb_c9552150374f4ef48b7bdbba53d59531.pdf
- https://static.usrfiles.com/ugd/36f25b_248f3b8575734e499719a0399d93d022.pdf
- https://static.usrfiles.com/ugd/1ee69b_f2d917d0ab6e4fc98fbbb0bc0b144a03.pdf
- https://static.usrfiles.com/ugd/b8c837_8028f4da2d2a46c0b3c7dbafc63859d9.pdf
- https://cdn.shopify.com/s/files/1/0433/2647/2345/files/66680190178.pdf
- https://cdn.shopify.com/s/files/1/0432/5471/0427/files/communication_between_unicellular_organisms_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0430/5613/6341/files/96187801541.pdf
- https://cdn.shopify.com/s/files/1/0434/1379/9066/files/musadewuletak.pdf
- https://cdn.shopify.com/s/files/1/0440/4923/6118/files/wesewu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e94.bin` `515773d9b93c54b2fa3d29a6fb521e4313bfe4fb812394e34cbf0ecf16a43f22`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E94	5084 bytes
`font_01_sfnt_off00006feb.bin` `c528599f70b6977f0a164b6fa1d300d722fee718180e07f8b692f1df57c0e340`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6FEB	10836 bytes
`font_02_sfnt_off00009488.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9488	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.