PDF malware analysis — malicious · 99f6504d53fabba4

MALICIOUS

PDF

55.5 KB Created: 2020-08-30 21:37:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 762efe9467f68b3ad77e1f4030bdcecb SHA-1: da2203163f21d4edae8ad9d887cf30db6613df9f SHA-256: 99f6504d53fabba48374d194b008c5bf811a168f4129555d154aecbe58b6adf2

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is disguised with a seemingly relevant keyword. The document also functions as a link farm, directing users to numerous other PDFs hosted on static.usrfiles.com. This suggests a phishing or redirection campaign aiming to lead users to malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=hibridacion+y+geometria+molecular+pd
- https://static.usrfiles.com/ugd/a48928_c025b2d88cf04242a59e1da6bd81fade.pdf
- https://static.usrfiles.com/ugd/b8c837_2fdb5595d6d84fc2bf094d40cd297c78.pdf
- https://static.usrfiles.com/ugd/b8c837_c9e49ccab4d2473b92c51524267b7cea.pdf
- https://static.usrfiles.com/ugd/26481d_51b2389251584334850a90acf243f9e9.pdf
- https://static.usrfiles.com/ugd/b8c837_4ef59de70b2542929d34f1e4a13040d5.pdf
- https://static.usrfiles.com/ugd/6f58fb_49c38fb76f484db59fb4dfb01a625bfa.pdf
- https://static.usrfiles.com/ugd/345929_d6b79ab1cfcc4466b615ab499d4f66fa.pdf
- https://static.usrfiles.com/ugd/accd1f_8e812ae4e95e43479b4d83bfff2334ba.pdf
- https://static.usrfiles.com/ugd/b8c837_7a1f6474fed54c249223072402c99dc0.pdf
- https://static.usrfiles.com/ugd/b8c837_f56671191947460eb84ea13a712d7700.pdf
- https://static.usrfiles.com/ugd/b8c837_114f6fa836b74e938d7a4e247ad61e08.pdf
- https://static.usrfiles.com/ugd/cbdbb6_cc61b2941eab4baab31ea30166a7c65f.pdf
- https://static.usrfiles.com/ugd/b8c837_a141e5303cdf4d0892d752e5f9f955af.pdf
- https://static.usrfiles.com/ugd/b8c837_ff10f24e6597413396d47af256bffd89.pdf
- https://static.usrfiles.com/ugd/b8c837_84f8ae46630a4b688afbf3f941bb323a.pdf
- https://static.usrfiles.com/ugd/83e24f_dd5968791bed4b18aac2a7cd94b2b7de.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006bbd.bin` `652dbc1561be70a167b1a3b415371c6f76e7874dafe613655408bf5a181c1a6e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6BBD	4020 bytes
`font_01_sfnt_off00007a15.bin` `a9e287047745a04c4d6acdd3c27be4b3aecc94cb520c8e37a74496dce5168924`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A15	5420 bytes
`font_02_sfnt_off00008c62.bin` `1cf1a3fd26fd56ef625d3c9839905da726a46a62c53838b843191cbd35912414`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C62	14908 bytes
`font_03_sfnt_off0000bb2f.bin` `b7faa10ee9f005c5ef285fb7128f621f08bb6f6929825552e74f2d75924efc29`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBB2F	16200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.