PDF malware analysis — malicious · a6542e52d96dff91

MALICIOUS

PDF

38.7 KB Created: 2020-08-12 18:54:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 49e058fa49d7613ccaa805b09e7a4275 SHA-1: c8bae6e9cb39fc15b95bcefb3c9a47fd4503ab4c SHA-256: a6542e52d96dff91dd773abf6bb31e8cb95388e2588b6e7e24b994d7d5550b24

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with a critical heuristic identifying a malicious redirector at 'https://ttraff.com/wb?keyword=noun%20phrase%20worksheet%20grade%204'. The document body, though partially corrupted, suggests a lure related to educational worksheets. The presence of a link farm further indicates an attempt to distribute malicious content or engage in SEO abuse for traffic redirection.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wb?keyword=noun%20phrase%20worksheet%20grade%204
- http://files.brandikphoto.com/uploads/1/3/0/8/130813095/fa69f14a2a5.pdf
- http://vukowiji.csgsps.co.uk/uploads/1/3/0/7/130738614/loxunuligubu.pdf
- http://files.misaferhospitals.org/uploads/1/3/1/6/131637307/172271.pdf
- http://files.lasttimetheywon.com/uploads/1/3/0/8/130874160/e3b7f394.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/99744184538.pdf
- https://cdn.shopify.com/s/files/1/0435/2750/4024/files/88137404683.pdf
- https://cdn.shopify.com/s/files/1/0429/3728/6812/files/36085419515.pdf
- https://cdn.shopify.com/s/files/1/0438/3241/0272/files/2018_mustang_brochure.pdf
- https://cdn.shopify.com/s/files/1/0434/3883/3816/files/fiwuzij.pdf
- https://cdn.shopify.com/s/files/1/0430/8487/3879/files/definicion_de_anemia_hemolitica.pdf
- https://cdn.shopify.com/s/files/1/0435/9002/5375/files/rodawutebusonelafap.pdf
- https://cdn.shopify.com/s/files/1/0437/0392/6939/files/klb_biology_book_1.pdf
- https://cdn.shopify.com/s/files/1/0433/5563/5880/files/bodigerejave.pdf
- https://cdn.shopify.com/s/files/1/0436/0355/8564/files/57127170993.pdf
- https://cdn.shopify.com/s/files/1/0428/0470/7491/files/passover_haggadah.pdf
- https://cdn.shopify.com/s/files/1/0430/4614/2114/files/79263947883.pdf
- https://cdn.shopify.com/s/files/1/0438/2117/0850/files/dujekemevamopemuviju.pdf
- https://cdn.shopify.com/s/files/1/0430/8333/3786/files/zebinubipisalufoxa.pdf
- https://cdn.shopify.com/s/files/1/0432/7079/9510/files/viter.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005841.bin` `f9f091a1480cf952122e3e3c31ab13cd113f32f26942cdc23b5518b24fb52591`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5841	5404 bytes
`font_01_sfnt_off00006ab4.bin` `38f16e2eb52741b6c1e47c91d7b1665497b5cd9e641a1c2f6c666371b4a190ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AB4	10320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.