PDF malware analysis — malicious · ad6254e32efeb4e2

MALICIOUS

PDF

48.8 KB Created: 2020-09-12 00:47:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fe32cd0b0f011060bc75fffa3208a56f SHA-1: e6e043ad9e0f003cb7e73e9d7e206eb5756106ec SHA-256: ad6254e32efeb4e2a82d2aa79a2f00e3b212e16327d3a535ff4af1d0505f65fc

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, which is also present in the document body. This link, 'https://ttraff.link/wix?keyword=law+of+attraction+meditation+guided', is designed to lure users to malicious infrastructure. The file also exhibits characteristics of a PDF link farm, with numerous embedded links pointing to external PDF documents, suggesting an attempt to manipulate search engine results or distribute further content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=law+of+attraction+meditation+guided
- https://static.usrfiles.com/ugd/6f58fb_09e03fcd0ffe4309bbed33800eaee826.pdf
- https://static.usrfiles.com/ugd/9dda13_ed5c9adf042b48ddbb95af6bba4bed92.pdf
- https://static.usrfiles.com/ugd/a421e3_9005e1dc8a7b4b98833b69530183c415.pdf
- https://static.usrfiles.com/ugd/b7ab08_c0e9f8cf129c444eb931126e8b452dcd.pdf
- https://static.usrfiles.com/ugd/05e3ad_35fe82e2909543fba822d81329f63cc3.pdf
- https://static.usrfiles.com/ugd/96bf9d_bda581ae513a46d583349e2a97621054.pdf
- https://static.usrfiles.com/ugd/0251f0_ae56401a8a4643219b4bd16fa4ad073e.pdf
- https://static.usrfiles.com/ugd/3bbd68_80b7f4ea0fd24296bad79fdfdcbf07dd.pdf
- https://static.usrfiles.com/ugd/035627_4d697a3924ca468ba76a2897ad7f7ff2.pdf
- https://static.usrfiles.com/ugd/238140_bb8b431ca1c8486eaca8fb79f69fc9a4.pdf
- https://cdn.shopify.com/s/files/1/0428/4717/4822/files/64733477703.pdf
- https://cdn.shopify.com/s/files/1/0428/8184/3356/files/guvug.pdf
- https://cdn.shopify.com/s/files/1/0434/3142/8248/files/protein_structure_ppt_free.pdf
- https://cdn.shopify.com/s/files/1/0437/3915/2535/files/sawidepaxewalo.pdf
- https://cdn.shopify.com/s/files/1/0437/7106/8577/files/83278480927.pdf
- https://static.usrfiles.com/ugd/a76634_87a6874ee7f6478b9db1f47f40ca8c7a.pdf
- https://static.usrfiles.com/ugd/12f4eb_211a76c4b4d04e5392ff2d2c57e66850.pdf
- https://static.usrfiles.com/ugd/917232_42718725e35c44bb84fc6d1755a527ad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000833e.bin` `9b53a94b0c70023dd185a32db7c215643e6308aa269bf97c0d35d1391f274e8d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x833E	5164 bytes
`font_01_sfnt_off000094d4.bin` `cdee18e33870b8603abe8836b975867070c60a1858f6a85c5a8a7e40f4b39da8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x94D4	9716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.