PDF malware analysis — malicious · a87515017a3a2e67

MALICIOUS

PDF

41.1 KB Created: 2020-09-09 12:49:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5560032e7eadc023a35dc83bd79eebd8 SHA-1: ad892cbb2c5d0cb447a73f636702d191063fdc48 SHA-256: a87515017a3a2e6749fc38345b0a82ab46acb82e101332982bb8cf268c432446

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it points to malicious infrastructure. The document body, though heavily obfuscated, contains text related to 'great migrations ielts reading answers pdf' and includes the malicious URL. This suggests a phishing or scam attempt designed to trick users into clicking the link, likely leading to further malware download or credential harvesting.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=great+migrations+ielts+reading+answers+pdf
- https://static.usrfiles.com/ugd/b8c837_50fb5fd106654119a8fcc2913c9d35d5.pdf
- https://static.usrfiles.com/ugd/c0fca2_c2f17486f96c414bbb312cb52a20df60.pdf
- https://static.usrfiles.com/ugd/c1108c_263d64f9c63d4f36a253b0b5d64dc701.pdf
- https://static.usrfiles.com/ugd/8b2c09_55c64ba044fe4e8ab1639e7f9eee376a.pdf
- https://static.usrfiles.com/ugd/59deca_1549cd4040cc4d0480b719b79910bcf8.pdf
- https://static.usrfiles.com/ugd/4dded2_8236ab7ba0c44d6da8c60239c1a31c5d.pdf
- https://static.usrfiles.com/ugd/80c1db_8304e977d6c04811a7b5c82761ffdab4.pdf
- https://static.usrfiles.com/ugd/26481d_8d9b148942da46a894b416632be44108.pdf
- https://static.usrfiles.com/ugd/8da65f_7901d9914a9b4fa9a06d39f37174c39a.pdf
- https://static.usrfiles.com/ugd/ee6100_81e2673ea398439094aaceaad06bfbfb.pdf
- https://static.usrfiles.com/ugd/1a89c8_08ec519bbd134f4882e87d12dae632c0.pdf
- https://static.usrfiles.com/ugd/b8c837_854c2fd46a664c888cd916e048a33000.pdf
- https://static.usrfiles.com/ugd/fdee49_9332418fdbc44355a10e2c1827bf20fc.pdf
- https://static.usrfiles.com/ugd/d1d005_b1a271802d624a8bba80be08dc923a04.pdf
- https://static.usrfiles.com/ugd/bb13a2_051fb80f92d24cf0be9f03190c953247.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006256.bin` `7bd03223bfee3b6cfc7f3b712ddecc8c0b29005e054ce7b3af2615e5ca18f68b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6256	5484 bytes
`font_01_sfnt_off000074f7.bin` `478e112071ae4f566bbf066a2d7eaf295686cf5fb6fe6730669de2a9a3988513`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x74F7	9936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.