PDF malware analysis — malicious · a0b842fbaba681f9

MALICIOUS

PDF

51.0 KB Created: 2020-08-30 04:24:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 952e13441e09da0c8f73749f92a98930 SHA-1: 341e65de30384349b272a0702ac1f49546f135da SHA-256: a0b842fbaba681f9f129c8fbaf895d7972882edd9eb751c9ed9643e8438f862c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with one pointing to a known malicious redirector. The document body is heavily obfuscated but contains the URL 'https://ttraff.ru/wix?keyword=wakfu+enutrof+guide', which is flagged as malicious. The presence of numerous links to static.usrfiles.com suggests a link farm or content distribution network used to host a large number of PDFs, likely for SEO poisoning or to distribute further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=wakfu+enutrof+guide
- https://static.usrfiles.com/ugd/23b571_6e0977262c294b04bd28f35f0031ac5a.pdf
- https://static.usrfiles.com/ugd/173616_a511aca3cca24bf8987a7c7cbab9a864.pdf
- https://static.usrfiles.com/ugd/b8c837_2ac059802fc34f08872ac0a45fc587c4.pdf
- https://static.usrfiles.com/ugd/b8c837_2fde680701e94438affd19eb660002ba.pdf
- https://static.usrfiles.com/ugd/72b0e7_7f909232572b46e2b8262e34371bd1c8.pdf
- https://static.usrfiles.com/ugd/b8c837_f30c5b81840947059d01847d45cdc094.pdf
- https://static.usrfiles.com/ugd/625844_7d96e800f7444854bb9b588e929e378d.pdf
- https://static.usrfiles.com/ugd/b8c837_c817e777ffad4352919e13822e8f704a.pdf
- https://static.usrfiles.com/ugd/cf14a4_15b9aa6ce2bc474fa5e883cfc922a570.pdf
- https://static.usrfiles.com/ugd/b8c837_c7112932bd574c32bcf9b88ad9cab949.pdf
- https://static.usrfiles.com/ugd/b13fd1_27862d7d17d545ab981ea544afa4a101.pdf
- https://static.usrfiles.com/ugd/73f3b0_f84c9229062f48d698fbcc762846e393.pdf
- https://static.usrfiles.com/ugd/b8c837_e4116cbfc5b2404e88eeecc4fc0422ce.pdf
- https://cdn.shopify.com/s/files/1/0436/9183/5547/files/3132589587.pdf
- https://cdn.shopify.com/s/files/1/0437/5370/1525/files/mei_lin_7_pro_bundle.pdf
- https://cdn.shopify.com/s/files/1/0430/7396/2145/files/longman_picture_dictionary_free_download.pdf
- https://cdn.shopify.com/s/files/1/0435/3415/5928/files/solving_cubic_equations_worksheet_answers.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000089dc.bin` `eceed8ec1f674758836ee916b52e371d9de62e07c493322f66eeae9c3526352b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x89DC	4944 bytes
`font_01_sfnt_off00009ad5.bin` `9ea0d53a1de19a177102d9c3262f9a18d23bc00ead52252660ff01d8106a6b13`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9AD5	10872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.