PDF malware analysis — malicious · aa1e9ac4c7709119

MALICIOUS

PDF

46.7 KB Created: 2020-09-07 03:50:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 85bb9eac070264a5f395262badb84aeb SHA-1: 633f00ee0ea8441a2f4057181c1df886c5fb9d15 SHA-256: aa1e9ac4c77091194c458ffc63f3102010addf13263317f05e2b411656e1f117

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a 'ct dmv abandoned vehicle form' and includes urgency language. The document also hosts a large number of external PDF links, many pointing to static.usrfiles.com, suggesting a link farm or redirection strategy. The primary malicious URL is https://ttraff.club/wix?keyword=ct+dmv+abandoned+vehicle+form, which is flagged as a malicious redirector.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=ct+dmv+abandoned+vehicle+form
- https://static.usrfiles.com/ugd/2f07a1_ee8ab7120be44dc297652701d18764d7.pdf
- https://static.usrfiles.com/ugd/dfb5f8_5b25cd0bbe064309b3c66d20846aa1f1.pdf
- https://static.usrfiles.com/ugd/cd81e9_d96b7c7ba6454a8cbad3c3fdbbebceab.pdf
- https://static.usrfiles.com/ugd/90423f_a7a7fef92d9a49f0b410229dcfa175e1.pdf
- https://static.usrfiles.com/ugd/4479ed_900da57af3a3414a9519ddb94d2bfb8b.pdf
- https://cdn.shopify.com/s/files/1/0440/6237/6088/files/zowezumifikaxenewafufo.pdf
- https://cdn.shopify.com/s/files/1/0464/9022/2744/files/total_insurance_incident_report_ielts.pdf
- https://cdn.shopify.com/s/files/1/0430/4237/3785/files/bose_soundsport_free_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/4283/1522/files/bilati.pdf
- https://static.usrfiles.com/ugd/70a38d_22599f533dea48e8b28352aeed493d29.pdf
- https://static.usrfiles.com/ugd/418e76_10c071492a49450d9f4462050dcaca90.pdf
- https://static.usrfiles.com/ugd/f8de3e_e729cca4452c456caa4229ddb9dba4f6.pdf
- https://static.usrfiles.com/ugd/83e584_0ed226b77dea4fb9b5e6a54c5e499a2f.pdf
- https://static.usrfiles.com/ugd/3fb742_236aefc5de3e469ca6d27d1cdf8ee84e.pdf
- https://static.usrfiles.com/ugd/b8c837_4ad4ce883e724c28ab0be85e305d562f.pdf
- https://static.usrfiles.com/ugd/b8c837_32f6563762d24f5e9b8764a9afd3a3ee.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000797c.bin` `1da4b0dd269e628fc6f7b93541bbd8c26119d0bb2ba28f00def9c35d69936104`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x797C	5188 bytes
`font_01_sfnt_off00008af9.bin` `e26ce4583c255646aee5ffd1eea8908e9e5ce3cb078fdc2014ee5a339c1ea8de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8AF9	10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.