PDF malware analysis — malicious · 97978f751d4315d1

MALICIOUS

PDF

45.5 KB Created: 2020-08-31 07:57:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 895c8dcb6fc06a8d171cbba9b999365f SHA-1: a01efd23f2021c3f04ba2d52afbc2c044363365b SHA-256: 97978f751d4315d101ae9a12d20da96df698f3168ee136010d914a2d3d05dd96

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a link to a known malicious redirector, ttraff.ru, which is disguised as a health risk assessment plan. The document also contains a large number of links to external PDFs hosted on static.usrfiles.com, likely part of a link farm to improve SEO for malicious content. No scripts were extracted from this sample, but the embedded malicious link is sufficient to indicate a phishing or redirection attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=travma+riski+hem%25C5%259Firelik+bak%25C4%25B1m+plan%25C4%25B1
- https://static.usrfiles.com/ugd/b8c837_b3b48d59ede94b7883bcbf356d67dda8.pdf
- https://static.usrfiles.com/ugd/e7e4a0_5542df5437e84e04b83e9f1602f68dbc.pdf
- https://static.usrfiles.com/ugd/b8c837_f85a0c8408f24b5a8176195d23d1c47f.pdf
- https://static.usrfiles.com/ugd/89064d_f1ff0ee208ab490e816189c1940d14f5.pdf
- https://static.usrfiles.com/ugd/451461_01a63b007ee74ac580d7014e0dbda740.pdf
- https://static.usrfiles.com/ugd/8cbfce_1362a47b27d94e8b961fa266da489b3f.pdf
- https://static.usrfiles.com/ugd/b8c837_35f541860a7a4d03b64aaf45e2b94f5f.pdf
- https://static.usrfiles.com/ugd/f3ecbe_01479f615f944e6e845a5af47c6e52b6.pdf
- https://static.usrfiles.com/ugd/b8c837_2b0c942838774af2964df5ff3177f97c.pdf
- https://static.usrfiles.com/ugd/3f0e57_9be88b21eff34aed8645944bf5a3aa69.pdf
- https://static.usrfiles.com/ugd/34e21e_4fb06f0e238c462f8ab3326685254cfd.pdf
- https://static.usrfiles.com/ugd/63022f_37c7dd2c3861467385bfd55926313637.pdf
- https://static.usrfiles.com/ugd/5fd5c1_80b4945b91bb46bdab32de85af0b5b2a.pdf
- https://static.usrfiles.com/ugd/b8c837_d2fc01be6ca84681814b5d766f228403.pdf
- https://static.usrfiles.com/ugd/76b6de_db3424980fb94e1abad287b528315ec2.pdf
- https://static.usrfiles.com/ugd/8ab72e_69d29d2a4b4d4fa48b86d58b33fe5952.pdf
- https://static.usrfiles.com/ugd/0c4177_36350402afd949e89ff0a9cc558e6b5a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000063cb.bin` `2740560705483730420ac60552a57ebbcfc0fb9c1778416f483978dc5d79e2bb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x63CB	5152 bytes
`font_01_sfnt_off00007488.bin` `d11b20ce6b0b848532309407ed51209d3a41c9bc4bac330cb15fd9c119f79081`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7488	11528 bytes
`font_02_sfnt_off00009868.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9868	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.