PDF malware analysis — malicious · a8afbdd3dfd166c4

MALICIOUS

PDF

39.2 KB Created: 2020-07-21 21:03:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4c2568a6c069749b80ea23e1bd76e25a SHA-1: 9b2fdae1eff951cd3a5266f460bf7e994204877f SHA-256: a8afbdd3dfd166c4ec043d6913816423aada91e8f7eb290f448c4cd6fb833ba8

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains numerous links, identified as a link farm, designed to redirect users to malicious sites. One such link, presented with a keyword suggesting an English test, leads to a redirector at 'ttraff.cc'. This indicates a social engineering tactic to trick users into visiting potentially harmful content. No scripts were extracted, limiting the analysis of further payload delivery mechanisms.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wb?keyword=advanced%20english%20reading%20test%20with%20answers%20pdf
- http://files.michaelsmarketingagency.com/uploads/1/3/0/7/130775018/5c47e.pdf
- http://files.eracognita.com/uploads/1/3/1/3/131381804/3e81c1ce1.pdf
- http://files.anniesullivanband.com/uploads/1/3/0/9/130969572/felurajelovorab.pdf
- http://files.thecluckingpig.com/uploads/1/3/0/7/130738553/e9d13edb22978c.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/11067845032.pdf
- https://cdn.shopify.com/s/files/1/0431/4942/6839/files/65884394744.pdf
- https://cdn.shopify.com/s/files/1/0433/4944/2713/files/55338734825.pdf
- https://cdn.shopify.com/s/files/1/0433/9325/3526/files/60123325664.pdf
- https://viximoko.files.wordpress.com/2020/07/farexigo.pdf
- https://pukunujiroxa.files.wordpress.com/2020/06/nedixagejofinigij.pdf
- https://xugitonatuv.files.wordpress.com/2020/07/3063067579.pdf
- https://cdn.shopify.com/s/files/1/0438/7520/5288/files/pisudilovuminodizu.pdf
- https://cdn.shopify.com/s/files/1/0434/2962/6017/files/29597389592.pdf
- https://cdn.shopify.com/s/files/1/0431/8488/1824/files/vezexabuxe.pdf
- https://cdn.shopify.com/s/files/1/0430/4296/3613/files/41449583087.pdf
- https://cdn.shopify.com/s/files/1/0428/3518/1724/files/75981621279.pdf
- https://cdn.shopify.com/s/files/1/0434/5574/2114/files/18032369369.pdf
- https://cdn.shopify.com/s/files/1/0429/6802/3194/files/85743995093.pdf
- https://cdn.shopify.com/s/files/1/0434/5892/0610/files/welujiropokibufukiv.pdf
- https://cdn.shopify.com/s/files/1/0430/0688/6051/files/zebugikixuxexudet.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005b3d.bin` `8e343685abe7f7658f503eb5c6ba64e62168ebeace23ed6d472ab2e90295c7c7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B3D	5236 bytes
`font_01_sfnt_off00006d18.bin` `69c4cda7eeaec88c08cb38e4ed783525a671f4d45de1bb73baa440bae17e9b6d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6D18	10036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.