PDF malware analysis — malicious · a3788e1ea598fa86

MALICIOUS

PDF

51.0 KB Created: 2020-09-02 03:56:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3a81751e6d2cdde162ffa8eb633f809d SHA-1: 2a7300b7c46e4870f0a4bfc8ced7bb5de919dc56 SHA-256: a3788e1ea598fa8604ebec7d9f3978830939532efaf27065cf69bb0abaf36616

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, including a critical redirector link to 'ttraff.cc', suggesting a lure to a malicious site. The document body, though heavily obfuscated, contains the same URL, indicating it is the primary payload delivery mechanism. The presence of numerous PDF links points towards a link farm or SEO poisoning technique to attract victims.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=regulatory+reporting+analyst+salary+ubs
- https://static.usrfiles.com/ugd/b8c837_fafa41c826854254940890c10bed8360.pdf
- https://static.usrfiles.com/ugd/63022f_6be4cc3e81c74f919df7e70a54f883ec.pdf
- https://static.usrfiles.com/ugd/0fdb6d_d7f57f61107b4e59b19837198b81b982.pdf
- https://static.usrfiles.com/ugd/5d2cf3_7e03e9f0ad554bf7aaec7f638fbbcc84.pdf
- https://cdn.shopify.com/s/files/1/0435/5178/5109/files/ssc_stenographer_question_paper_2020_in_english.pdf
- https://cdn.shopify.com/s/files/1/0434/0629/5201/files/77200615473.pdf
- https://cdn.shopify.com/s/files/1/0430/4027/6642/files/72440888438.pdf
- https://cdn.shopify.com/s/files/1/0436/9186/8313/files/xikulasid.pdf
- https://cdn.shopify.com/s/files/1/0430/6819/4978/files/398568001.pdf
- https://cdn.shopify.com/s/files/1/0437/7713/0647/files/toporor.pdf
- https://cdn.shopify.com/s/files/1/0428/9308/2783/files/minecraft_1._14._4_fabric_mods.pdf
- https://static.usrfiles.com/ugd/d2751c_dd891bc64c84415a98cad2e8d8e30a87.pdf
- https://static.usrfiles.com/ugd/865d50_d417fd5441a74e9480fa7861c7fc0011.pdf
- https://static.usrfiles.com/ugd/9f06f8_c803c05f12034ebf810cb1755ff9eaac.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064e4.bin` `480225fcbdd66d08c0472a0a565235f1efac786a05262752078e6b4f106500b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64E4	5116 bytes
`font_01_sfnt_off00007664.bin` `99d97256a82856aedaec836970b10793e37bfeb755f42d09b667565403868666`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7664	10860 bytes
`font_02_sfnt_off00009bb5.bin` `ead7fd593d7f5feef6f283420e9b55f8fa4552f107c64b0063d474dd3355abd8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9BB5	16164 bytes
`font_03_sfnt_off0000b0ce.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB0CE	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.