PDF malware analysis — malicious · 914928a61b6a5270

MALICIOUS

PDF

40.3 KB Created: 2020-09-06 11:53:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fa8cb362e137f890efae0b132d868ead SHA-1: 403b57fda581d7cb36cd3e7006c46bf644ed95b7 SHA-256: 914928a61b6a52703017c8c3982da07c034e56c2f15ca682ac4ceb802bd652c7

140 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=sheet+street+buy+airtime'. Additionally, it exhibits characteristics of a link farm, with numerous embedded URLs. The document body, though partially corrupted, contains text related to 'sheet street buy airtime' and the malicious URL, suggesting a lure for a scam or phishing attempt. The presence of a callback lure heuristic further supports a phishing or scam context.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=sheet+street+buy+airtime
- https://static.usrfiles.com/ugd/b8c837_67d04f1d24194b81b01a8012bb7b7ad4.pdf
- https://static.usrfiles.com/ugd/ce14f3_9d0c42629d54469498e2935ffce9f7f4.pdf
- https://static.usrfiles.com/ugd/e8506d_d44bb210c1e94f35ae340ea69ad4cb0b.pdf
- https://cdn.shopify.com/s/files/1/0434/3191/9765/files/59502721445.pdf
- https://cdn.shopify.com/s/files/1/0437/6287/6565/files/wogizawezanenabiga.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/16485275060.pdf
- https://cdn.shopify.com/s/files/1/0431/4952/5156/files/xesenepixunodajavuxefok.pdf
- https://static.usrfiles.com/ugd/8c7d07_bda34577b2434d619abe0fa4bb83a121.pdf
- https://static.usrfiles.com/ugd/b8c837_dc080baa162646358e8b757e5896221d.pdf
- https://static.usrfiles.com/ugd/b8c837_3a08abdde3d64b1598a162903453a622.pdf
- https://static.usrfiles.com/ugd/b6aaa0_9b38b0af94cc442c8e2b750c06763203.pdf
- https://static.usrfiles.com/ugd/f55bec_001b39a3e2ea43699095e39890f3b410.pdf
- https://static.usrfiles.com/ugd/e2a635_2287d8d1f6fb41689ae1958ba45a03f7.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006011.bin` `e3d692b2a83db01bcb94d8d8105d8f63b22ebba7e10ac7b59e663d6b556ed647`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6011	5236 bytes
`font_01_sfnt_off000071bb.bin` `44df9b67d60bef09fb0f0b3692c3f277989d34a5f03e3d9849fbaade8809f5f9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71BB	10060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.