PDF malware analysis — malicious · 8fff5691b0544833

MALICIOUS

PDF

40.6 KB Created: 2020-08-29 02:27:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 894f914e3728db2fcd885ad3eb3eb0af SHA-1: c39c6f1a7854add549124ff99016234f5c1f2c49 SHA-256: 8fff5691b0544833ab6a544150e61ae3c0b2800f89df4cc3fb3e269d12265fa1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating a link to known malicious infrastructure. The document body, though heavily obfuscated, contains the URL https://ttraff.com/wix?keyword=origins+trial+of+the+gods, which is likely intended to redirect the user to a malicious site. The PDF also exhibits characteristics of a link farm, with numerous embedded links to static.usrfiles.com, suggesting a broader campaign to distribute malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=origins+trial+of+the+gods
- https://static.usrfiles.com/ugd/b8c837_8432177643f44956bbf81b136dba065b.pdf
- https://static.usrfiles.com/ugd/b8c837_95e5cb01b1154f729be73f86dfc0e7f6.pdf
- https://static.usrfiles.com/ugd/b8c837_cc094715d9b24a4fb7148df98740b45c.pdf
- https://static.usrfiles.com/ugd/b8c837_0fe11e7c47d4433ea45e51b9abd3f34b.pdf
- https://static.usrfiles.com/ugd/b8c837_bdc032211353441aaf2642c7d3f9f21f.pdf
- https://static.usrfiles.com/ugd/b8c837_5e62f1516f9c4afb9865df6a7e78f68b.pdf
- https://static.usrfiles.com/ugd/b8c837_658eb02af51e4b33abb5bdd290bff5be.pdf
- https://static.usrfiles.com/ugd/b8c837_f25449f8f3d245d2bead0c1867bef2d9.pdf
- https://static.usrfiles.com/ugd/b8c837_21746769b7df4ad4b972569c2d0c0613.pdf
- https://static.usrfiles.com/ugd/b8c837_6f6068acbefa42d9a9039bad35eae4bf.pdf
- https://static.usrfiles.com/ugd/b8c837_9b379de2e3ad4784b77d7e57621d9fbe.pdf
- https://static.usrfiles.com/ugd/b8c837_bc4811e10edb45acbd096aa9428404c1.pdf
- https://static.usrfiles.com/ugd/b8c837_2fcc576ca8564adf9185efd0e838529a.pdf
- https://static.usrfiles.com/ugd/b8c837_54b7dcf7a2be4aa09672ee1cf0f27ae1.pdf
- https://static.usrfiles.com/ugd/b8c837_2832e418af6d455aae9d5866b4f4d745.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000061ea.bin` `e2cccc036f3a7c9737429e6fd025afd558c1b214c7920b526416c5d4587879de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61EA	5196 bytes
`font_01_sfnt_off00007382.bin` `a68fb8c7969ce24b453432ca96f402b0b15bce913eed7bc93c1df04cf788d2f0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7382	9992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.