PDF malware analysis — malicious · 9d3f203c210ec008

MALICIOUS

PDF

46.3 KB Created: 2020-08-29 13:04:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 40768f2c45d6980288ec1cc019b524c2 SHA-1: 33d2c5639cf3c658b683ed7b3409689a1ffc2a16 SHA-256: 9d3f203c210ec008008ecd4e7c3f4927b7bf2f946fc2907cafdc791b6f9718d7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, a common tactic for SEO spam and redirecting users to malicious sites. One such link, 'https://ttraff.ru/wix?keyword=evaluacion+de+proveedores+iso+9001+ejemplos', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains this URL, suggesting the primary intent is to redirect the user to this malicious domain. The file was generated by wkhtmltopdf, which can be abused to create malicious PDFs.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=evaluacion+de+proveedores+iso+9001+ejemplos
- https://static.usrfiles.com/ugd/b8c837_823f16bd4e6a43ed96410974cb865342.pdf
- https://static.usrfiles.com/ugd/b8c837_22f20fd1762a4057ae04fd19e1d84c00.pdf
- https://static.usrfiles.com/ugd/8e1900_70679c3d5b354204b0f7f07e614f9824.pdf
- https://static.usrfiles.com/ugd/b8c837_a758d134404a45d2b039a9c8f01d132b.pdf
- https://static.usrfiles.com/ugd/b8c837_e8ade5e9a72a46d2a013f43be6f77b37.pdf
- https://static.usrfiles.com/ugd/b8c837_80b8a4e5090542099a0308f65006ce3b.pdf
- https://static.usrfiles.com/ugd/b8c837_7257fe6e0ff84f8d828c00303559191e.pdf
- https://static.usrfiles.com/ugd/b8c837_21f6cabfffad41a5b9899de05f52b16f.pdf
- https://static.usrfiles.com/ugd/12dc78_b7c572ca6870468480c285ad64135792.pdf
- https://static.usrfiles.com/ugd/b8c837_e83e3481299b4288ad3cabdcf6e33d37.pdf
- https://static.usrfiles.com/ugd/b8c837_4e7b6f4437a048e1b1b8aa2b02122d92.pdf
- https://static.usrfiles.com/ugd/b8c837_40f16f11a69a442181997954451dbc2f.pdf
- https://static.usrfiles.com/ugd/b8c837_ca8dce59ae8643be993c3adc33c90af7.pdf
- https://static.usrfiles.com/ugd/b8c837_a141e5303cdf4d0892d752e5f9f955af.pdf
- https://static.usrfiles.com/ugd/b8c837_ae0e9126a33546a8a2ba2eddea92654a.pdf
- https://static.usrfiles.com/ugd/b8c837_a905ced1868b4c9397f96f1750eac592.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065b9.bin` `a69eb136ca9ba755eee85bd4fc77611a8b97429c29defce104e33799c2338bad`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65B9	5464 bytes
`font_01_sfnt_off00007830.bin` `50c758948f042c139c5cf14e3129b1879192e3c7a216d7b363957c0d402b4912`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7830	11232 bytes
`font_02_sfnt_off00009c49.bin` `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9C49	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.