PDF malware analysis — malicious · 942a12a84ca0a056

MALICIOUS

PDF

41.4 KB Created: 2020-08-29 00:08:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 71c8809d9a9f3b5736baac5ecc966b87 SHA-1: ddb7bb8364af7c20b5e31cecf422c273366aa2c8 SHA-256: 942a12a84ca0a056ab5c4de18e087b8dd477a5d7addc170772cd05e25df49673

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1200 Hardware Add-in T1059.001 PowerShell

The PDF contains a mass of external links, many of which are SEO-optimized and point to benign content, but one specific link, 'https://ttraff.cc/wix?keyword=meter+to+feet+conversion+pdf', is identified as a malicious redirector. This suggests the document's primary purpose is to lure users into clicking this malicious link, likely leading to a further stage of attack. The document body itself is heavily obfuscated but contains the malicious URL and numerous other benign PDF links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=meter+to+feet+conversion+pdf
- https://cdn.shopify.com/s/files/1/0429/1775/7095/files/episiotomy_types.pdf
- https://cdn.shopify.com/s/files/1/0464/6322/1912/files/live_guide_lumber_tycoon_2.pdf
- https://cdn.shopify.com/s/files/1/0432/4828/7904/files/bedelix_notice.pdf
- https://cdn.shopify.com/s/files/1/0431/7102/0957/files/aristotle_the_art_of_rhetoric_summary.pdf
- https://cdn.shopify.com/s/files/1/0463/9916/0475/files/everythings_an_argument_2016_mla_update_free.pdf
- https://cdn.shopify.com/s/files/1/0440/6693/0840/files/39888676849.pdf
- https://cdn.shopify.com/s/files/1/0429/5458/8316/files/a_wrinkle_in_time_final_test.pdf
- https://static.usrfiles.com/ugd/b8c837_afbd93ee4301402d84b82ea47b436e8b.pdf
- https://static.usrfiles.com/ugd/b8c837_4810765cda42431fb55a6e2685f164f0.pdf
- https://static.usrfiles.com/ugd/b8c837_7807c67147024923a9a68799d7abf13d.pdf
- https://static.usrfiles.com/ugd/b8c837_3db8d70ec69b49e1ad886180fd3dff05.pdf
- https://static.usrfiles.com/ugd/b8c837_d75f477f5cdd4ccfa9ca40fb59964d92.pdf
- https://static.usrfiles.com/ugd/b8c837_979e48bd6d234e64b21a0373b4d4efb4.pdf
- https://static.usrfiles.com/ugd/b8c837_c20eb92b6cb9488897b5fdd42d1e0f5c.pdf
- https://static.usrfiles.com/ugd/b8c837_9de4dfa3c6964f938a672be2f94dec18.pdf
- https://static.usrfiles.com/ugd/b8c837_6f7f3190808d45b599d585a6502508f3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000644b.bin` `f9b8a4c91d717705000a7344704a18986a67066a5bfd6253818cda007bac9c9e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x644B	4972 bytes
`font_01_sfnt_off0000755d.bin` `e79604bdafdf9b697bcc9e25a34e3d96be9f48c83381ceef173d1c035e38edbb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x755D	10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.