PDF malware analysis — malicious · b08b82f9f4bf6de7

MALICIOUS

PDF

65.3 KB Created: 2020-08-30 09:07:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e4e8f2180b77ed1be8512337ab3eaec5 SHA-1: 5114efd1ce210b0449952f21eee5bcd8646e687c SHA-256: b08b82f9f4bf6de7168d3cd8eb61ad2815e99de63a971ad413cb6dce536f9591

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded links, with one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' indicate a deliberate attempt to distribute malicious content. The presence of 'SE_PASSWORD_ARCHIVE_LURE' suggests that the document may be a lure for a password-protected archive, a common tactic to bypass gateway security. The embedded URL 'https://ttraff.cc/wix?keyword=1+AND+1%253D1+--' is flagged as malicious, further supporting the attack pattern.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=1+AND+1%253D1+--
- https://cdn.shopify.com/s/files/1/0435/2252/3288/files/47916628010.pdf
- https://cdn.shopify.com/s/files/1/0439/0230/4408/files/62902303232.pdf
- https://cdn.shopify.com/s/files/1/0431/8196/5474/files/android_sdk_install_ubuntu_16._04.pdf
- https://cdn.shopify.com/s/files/1/0436/4494/4542/files/mamepukenipa.pdf
- https://static.usrfiles.com/ugd/b8c837_601bd766f9cf48d49a9be0e25766fe9d.pdf
- https://static.usrfiles.com/ugd/b8c837_59eba415dd24402eadfa50bc7d0585f8.pdf
- https://static.usrfiles.com/ugd/0fdb6d_564c34229add489081bda04b106b009d.pdf
- https://static.usrfiles.com/ugd/07625c_1a8b0c21468c4eec859dc6d80a0441c2.pdf
- https://static.usrfiles.com/ugd/79cb75_658822f20ddf4fa1bb0760016b58e1ab.pdf
- https://static.usrfiles.com/ugd/b8c837_53b9671c08e244d49280a3d4cf1be3ab.pdf
- https://static.usrfiles.com/ugd/b8c837_82ca98d220124fa3a1cbac718eb95ff2.pdf
- https://static.usrfiles.com/ugd/33ab24_3ca518963a93423c9fc3fb45e6a3853a.pdf
- https://static.usrfiles.com/ugd/b8c837_ffb888ccdff74888b90bfa85a1dd202f.pdf
- https://static.usrfiles.com/ugd/b8c837_693ee6fde0234f50981d66cb7a8eb40f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b5b1.bin` `20a1a220ef6a6d645f68a4dbae43433d2e141ec92f0089ea5ace721510218043`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB5B1	4440 bytes
`font_01_sfnt_off0000c4f9.bin` `ab47aa231488a0455e85c7dc19bebc31e1cb36df133f05257d9562f657e61acc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC4F9	16124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.