PDF malware analysis — malicious · 9bda22e18f0d0dee

MALICIOUS

PDF

42.5 KB Created: 2020-09-01 01:21:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66bcdd69c9be257fb70fc3a2459d6765 SHA-1: ecd5f5815b23f244b7809152af440c177c333018 SHA-256: 9bda22e18f0d0dee0883745c15824880ddd52489eac5275475326e4a0660993f

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link and a large number of embedded links, suggesting a link farm. The document body text and heuristics indicate a social engineering lure to install a browser extension or viewer to see content, which is a common path for malware installation or credential theft. The primary malicious URL identified is https://ttraff.ru/wix?keyword=web+browser+to++videos, which is likely used to redirect the user to a malicious site.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=web+browser+to++videos
- https://cdn.shopify.com/s/files/1/0437/0441/8455/files/xerusuxulusotakokagin.pdf
- https://cdn.shopify.com/s/files/1/0432/1620/8036/files/30879001070.pdf
- https://cdn.shopify.com/s/files/1/0429/8942/0695/files/53745561846.pdf
- https://static.usrfiles.com/ugd/cc089a_c2fc0f93ea934f289509b281d118abf8.pdf
- https://static.usrfiles.com/ugd/97aff7_808c7220962a470f9bc02e8ee57d05c6.pdf
- https://static.usrfiles.com/ugd/b8c837_5469130d7b3d465a8025e6789ee5f130.pdf
- https://cdn.shopify.com/s/files/1/0435/6915/2159/files/vubozipakefisanodo.pdf
- https://cdn.shopify.com/s/files/1/0434/6557/2514/files/xobukobojufegu.pdf
- https://cdn.shopify.com/s/files/1/0435/0607/3759/files/brugge_bus_map.pdf
- https://static.usrfiles.com/ugd/c162b3_f8ba9d5be94e4974be321e98c5ccacdf.pdf
- https://static.usrfiles.com/ugd/e1c37d_438b48cd492b48edad1bc6e6c1b80674.pdf
- https://static.usrfiles.com/ugd/de3d83_ac49af9eb1314e388eb8da0fa1bce15f.pdf
- https://static.usrfiles.com/ugd/b8c837_5097ae9a06ab421aaeccb800d9fed630.pdf
- https://static.usrfiles.com/ugd/3be3a7_464707f64a6649b0ab7edbc2cd87bf4d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a16.bin` `745acb420211ce40dd04f58aeca124659e8268c1a8afc10cc5ae4f97d278805e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A16	4884 bytes
`font_01_sfnt_off00007ad5.bin` `84d2fb94a711a4c14e38bfa3f224393fe57dcb4326d5f110c0f05061690c61d9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AD5	10276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.