PDF malware analysis — malicious · 922ed90a6debf5ac

MALICIOUS

PDF

48.2 KB Created: 2020-09-19 01:27:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 55225ac1d42b5255291fb6a603c534f9 SHA-1: 623ec0040b936058c54b885db81b071f67f644fc SHA-256: 922ed90a6debf5ac59944fb04d628ae7f4ea9cd3b37979f1d6bbfe71805b4697

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, many of which point to a redirector infrastructure. The primary malicious link identified is https://ttraff.club/wix?keyword=11-5+adding+and+subtracting+rational+expressions+form+k, which is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL and other PDF links, suggesting a link farm or SEO spam tactic to lure users to malicious content. No scripts were extracted, and the maliciousness is solely derived from the embedded links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=11-5+adding+and+subtracting+rational+expressions+form+k
- http://zejemodis.icfkr.org/uploads/1/3/0/7/130775851/subugofikopavire.pdf
- http://files.littleladyo.com/uploads/1/3/1/0/131070561/8863646.pdf
- https://1d5bea97-2fd4-4a8c-b8e1-e6ad126ed21e.filesusr.com/ugd/d63aaf_23b911ddfbd0459cb4a1cbc8ded1ecc0.pdf?index=true
- https://38f20773-75da-4e02-8a40-934bf615f82a.filesusr.com/ugd/64bd79_0d5c72a273d14210a21fe11d83d825c6.pdf?index=true
- https://e84982e4-c02c-4447-ba80-54f93e5e5d90.filesusr.com/ugd/f3bfbb_a98f05347e844341bbf300921861e87f.pdf?index=true
- https://e6e8fab2-a72c-46e7-a7ce-085fe8ccb4c1.filesusr.com/ugd/04c368_849dd854ae7143958a42f025545b6249.pdf?index=true
- https://3c30db5b-6ef9-4dc2-b2ee-9272075fc109.filesusr.com/ugd/df4650_bc7121b7f99d4dc8bbf3746a10e87a32.pdf?index=true
- https://10fb71f5-d8d8-43c8-91a8-c65b771ac41d.filesusr.com/ugd/3be3a7_76d9cca6391048e5b9da01958908d646.pdf?index=true
- https://cdn.shopify.com/s/files/1/0435/7645/9422/files/6707947963.pdf
- https://cdn.shopify.com/s/files/1/0430/6599/9511/files/multiply_2x2_matrix.pdf
- https://cdn.shopify.com/s/files/1/0465/9013/2389/files/16970436447.pdf
- https://cdn.shopify.com/s/files/1/0437/0428/7383/files/85566259420.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005785.bin` `b1a80c9e6bbcda867738e00c4d60d9c6fb1611b9fd1f00fdf077fa0b6a4e359d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5785	5860 bytes
`font_01_sfnt_off00006b76.bin` `4acfb353586c8ece17e08ae4d2b3fe606c52bfea14c317afa03fc647b4532ce8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B76	15292 bytes
`font_02_sfnt_off00009c01.bin` `ae4c1039909c6b18400a693790947520403f0a9c3cdc5bdc37254682f4165006`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9C01	16080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.