PDF malware analysis — malicious · ab0b77bf731cbeeb

MALICIOUS

PDF

46.0 KB Created: 2020-08-29 16:48:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 54e7c042857d5af49f16e0bf71f7fb47 SHA-1: 7dfbf465a7ccbb331f2c563782b6398d3173ce0a SHA-256: ab0b77bf731cbeebec414c38fcaabf92eb513bbe77b25fdce141e6855cc66359

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was identified as malicious due to its extensive list of external links, a technique often used for SEO manipulation or to redirect users to potentially harmful websites. The primary malicious URL identified is 'https://ttraff.ru/wix?keyword=bodylastics+workout+videos'. While the document body contains text related to workout videos, this appears to be a lure to disguise the malicious nature of the embedded links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=bodylastics+workout+videos
- https://static.usrfiles.com/ugd/b8c837_2e30df528d5c4a059617592e02c5c9c6.pdf
- https://static.usrfiles.com/ugd/b8c837_97c468cfd3ee45e4b0c3034c15c84f8b.pdf
- https://static.usrfiles.com/ugd/2f3ac6_3497f23dc0c544fba089e92bd75b5983.pdf
- https://static.usrfiles.com/ugd/b8c837_042db4c71278417f95a5e63d6f565598.pdf
- https://static.usrfiles.com/ugd/b8c837_9108937628be4efc98c3d499e9fa7811.pdf
- https://static.usrfiles.com/ugd/b8c837_3ea909af08f64bdaa4c5220f14457c2e.pdf
- https://static.usrfiles.com/ugd/b8c837_a0c9fc0cac2149649eced41ed819b38c.pdf
- https://static.usrfiles.com/ugd/b8c837_66def0301fec4b8982a9bcd60fb46537.pdf
- https://static.usrfiles.com/ugd/a771bd_0d2d0a78c99c4310becde5a6dd5ce9fe.pdf
- https://static.usrfiles.com/ugd/b8c837_8e75c4aab1e141478626a75534c551cd.pdf
- https://static.usrfiles.com/ugd/b8c837_f940be56f27b41668b7cf9a291be08d0.pdf
- https://static.usrfiles.com/ugd/b8c837_f4f2d3a8e00f4a29adb9ef6f804fe0dd.pdf
- https://static.usrfiles.com/ugd/b8c837_7450f0a71b8442cc90548803a306cbe0.pdf
- https://static.usrfiles.com/ugd/b8c837_7c116ca5a92c4443b85e167e1339fb5c.pdf
- https://static.usrfiles.com/ugd/b8c837_20766bef1c0c4c12b0bc8654ff61b5e8.pdf
- https://static.usrfiles.com/ugd/b8c837_faaf3c9e0281428e8953186c81dee55c.pdf
- https://static.usrfiles.com/ugd/b8c837_9585a4372f034e088ff4e54519a577d5.pdf
- https://static.usrfiles.com/ugd/b8c837_b7c736fcd4804bb7bf76759468bbf45e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007346.bin` `ec8f06e4aa8b9327e0397222d9dd952dad4b800599464cfc21ba9b9a5e39caff`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7346	5300 bytes
`font_01_sfnt_off00008575.bin` `ea15df55cf876600a13049fea15ff16cbcbbae7a1c7eb4980292c87b26bc2545`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8575	10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.