PDF malware analysis — malicious · 9ff62af072ac8842

MALICIOUS

PDF

43.5 KB Created: 2020-09-02 03:55:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 058f689bf7b1594b29f81ddd32c83d09 SHA-1: 1006ccb60bb1fd29ac1e9016258126aaf08bbea7 SHA-256: 9ff62af072ac8842ecf2a265327b076b32a757bf44472968af2cb7d6f2f1c2b9

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a lure related to 'Safenet authentication client' and requests sensitive recovery information. It embeds a mass of external links, with the primary link pointing to a known malicious redirector at 'ttraff.com'. This suggests the document is designed to trick users into clicking malicious links, potentially leading to credential theft or further malware delivery.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=safenet+authentication+client
- https://static.usrfiles.com/ugd/de9003_173775b1157248d09c338003136aecc2.pdf
- https://static.usrfiles.com/ugd/b11f6d_fdc1cfe7c1b34049bc892327da9a44da.pdf
- https://static.usrfiles.com/ugd/5c9621_d732c41e384e4548b4b956698e237ffd.pdf
- https://static.usrfiles.com/ugd/b8c837_e4b7d39b72a64b3a9ebd791606d268f6.pdf
- https://static.usrfiles.com/ugd/7182f3_f96166cd57484009bb6b5a82cfda73b4.pdf
- https://static.usrfiles.com/ugd/7b00a0_8e09b70404ab4f0bba91808372704cd3.pdf
- https://static.usrfiles.com/ugd/b8c837_c4988329c7404ffa87ceea3411f0b592.pdf
- https://static.usrfiles.com/ugd/4c3ae3_22d3b5cf651548ea992b9109e61a66a7.pdf
- https://cdn.shopify.com/s/files/1/0462/6415/6314/files/81153207291.pdf
- https://cdn.shopify.com/s/files/1/0431/0496/0661/files/callen_thermodynamics_solutions.pdf
- https://cdn.shopify.com/s/files/1/0435/1292/2264/files/79263927119.pdf
- https://cdn.shopify.com/s/files/1/0429/0537/0791/files/daxizofuxujutoragozib.pdf
- https://cdn.shopify.com/s/files/1/0434/2769/2695/files/33613263607.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000058f0.bin` `fb4be9b9e04504236e848b53adba6dbdb98391379bf25299e0c7da36a49a5557`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x58F0	4796 bytes
`font_01_sfnt_off00006947.bin` `35397d281d3733db4563d852adb7a2c8dd9f0be12e325456b253c32567b22bfc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6947	10000 bytes
`font_02_sfnt_off00008baa.bin` `1cbb36bb7b1d233ee9f5c2cce214d5b3269f5c1575f9f3c623519b72eb7db796`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8BAA	16240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.