PDF malware analysis — malicious · acd6960eb9eb08b3

MALICIOUS

PDF

39.5 KB Created: 2020-09-20 11:51:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c8f271d6c7a755c92dc45cc1ec467e99 SHA-1: e0fbebba303cb0c00536856b88aa42cf769d72e2 SHA-256: acd6960eb9eb08b31a52ca7f52bd929fd8eaaa4e33725e24e6c25b1fe5c45ce1

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm designed to redirect users to malicious content, specifically promoting the download of cracked software. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK directly indicates the presence of a malicious redirector. The PDF_SEO_LINK_FARM heuristic further supports this by showing a large number of external links, many of which are likely part of the same malicious infrastructure. The document body also contains the lure text 'ttorrent pro apk cracked free download' and the malicious URL.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=ttorrent+pro+apk+cracked+free+download
- https://0e349a17-3c2e-41ca-8d90-cf24a8314ca1.filesusr.com/ugd/3e5db3_ee929d1c626b46e18100832a8472fa37.pdf?index=true
- https://863428ab-f80c-4151-b51b-dcecbb687550.filesusr.com/ugd/45e30f_4198423a8e9045e3ab7e3fa1c6932926.pdf?index=true
- https://07da515b-7e27-48a9-a1da-b3687cec26c5.filesusr.com/ugd/1acd69_bb31da0662cb48d6a6b09030d40f2242.pdf?index=true
- https://8c8dc528-17c4-418a-8196-96bee3cb90ba.filesusr.com/ugd/e50c99_ade6cb3c9e9342698ff1e446a50b24f8.pdf?index=true
- https://1cacd0c0-5b26-4a29-89ad-313b3c1d7358.filesusr.com/ugd/136d3d_479db310332f41f08621138f8491cc11.pdf?index=true
- https://df9ff5da-caa1-42b8-ac01-2d0011c87bae.filesusr.com/ugd/268ab1_aafbab31b0b94613a8aedd40fb0765c2.pdf?index=true
- https://f8a5f121-977f-4482-a048-51335f9cd9e5.filesusr.com/ugd/b4a829_8f5415ab84e44c719c8ad372b67aaf6d.pdf?index=true
- https://d3aa88db-8524-4d32-b08c-c3bf34ecf7ce.filesusr.com/ugd/3d514e_a183168a0cb947f292fe7264739d5de3.pdf?index=true
- https://153d1161-7d25-4ccd-94dc-248d6ae790b4.filesusr.com/ugd/a7074a_44796ec62e51476795a7cf2c02e2cf7f.pdf?index=true
- https://6eff6716-61b8-4e38-9a42-7cc1e0d345fb.filesusr.com/ugd/50988c_a5aa061af9f94319b8b8695d0e55a90d.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005ca9.bin` `53a5c4bb5ef40945795548eec280758a707b2d9075d7ba78ac1ebc6795611ccb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5CA9	5076 bytes
`font_01_sfnt_off00006e15.bin` `839890e5b35a15a9c8929e198e56626856716f311ce4305a3faea4342c0e91b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E15	10388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.