PDF malware analysis — malicious · ac5345f01741d724

MALICIOUS

PDF

42.9 KB Created: 2020-08-30 17:50:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5f660c1c81059b0fec448de137e82774 SHA-1: 54f68c2d56b93ae9d425ff4c6eb11047267b3fc3 SHA-256: ac5345f01741d724c5915fc71c336de51ee8b4545b9b5146359a643a272bb6ef

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged for containing a malicious redirector link and a large number of external PDF links, suggesting a link farm or redirection attempt. The primary malicious URL identified is https://ttraff.cc/wix?keyword=slope+of+parallel+and+perpendicular. The document body contains garbled text but also includes the same malicious URL, reinforcing its role as a lure. No scripts were extracted, and the file type is PDF, indicating a likely phishing or redirection attack vector.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=slope+of+parallel+and+perpendicular
- https://static.usrfiles.com/ugd/902d29_0ef1a8552cff44e195320031c9fd5f5e.pdf
- https://static.usrfiles.com/ugd/0df15e_3a5611aaf2e04a4193c15f563d2099c7.pdf
- https://static.usrfiles.com/ugd/b8c837_18b4dcb7af6a4cc18f8d0f2ff2453413.pdf
- https://static.usrfiles.com/ugd/b7ab08_3edc1803ba0143e9a965c75e534e7bf5.pdf
- https://static.usrfiles.com/ugd/516793_3f2164f4e16049999287f42967fdf6fd.pdf
- https://static.usrfiles.com/ugd/9ea9b6_aa066bd68f774d10b060d63e844b54a0.pdf
- https://cdn.shopify.com/s/files/1/0428/9521/2697/files/merge_files_with_acrobat_reader_dc.pdf
- https://cdn.shopify.com/s/files/1/0434/1887/8104/files/ladufivofurimanelimazixu.pdf
- https://cdn.shopify.com/s/files/1/0436/1358/5566/files/97296535059.pdf
- https://cdn.shopify.com/s/files/1/0450/9502/6840/files/anthropometric_data_for_interior_design.pdf
- https://static.usrfiles.com/ugd/b8c837_df0594bf9dcc475f9739fd2f7802f66a.pdf
- https://static.usrfiles.com/ugd/b8c837_1b6e61671bf14258ab38b24dae5e0cb3.pdf
- https://static.usrfiles.com/ugd/c3548c_160a7be3f58846aea534b9ac4b61fe22.pdf
- https://static.usrfiles.com/ugd/b8c837_013d51f8434549aa9d242b3c5c66603c.pdf
- https://static.usrfiles.com/ugd/8127dd_26606eb734d342f88430e432c7431e33.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005ca9.bin` `a09980f9931110c40a5f06bd992d0e64b38893ef5b5c1b24659c0696857ccb72`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5CA9	4876 bytes
`font_01_sfnt_off00006d37.bin` `61bb7939bddba51169833156b237b5ab5f28e23e7205591bd25419692c94b320`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6D37	10428 bytes
`font_02_sfnt_off000090d6.bin` `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x90D6	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.