PDF malware analysis — malicious · b14af5abbe056c2c

MALICIOUS

PDF

56.1 KB Created: 2020-09-01 02:52:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 29d29c281325fb0cc14010a97adbfdfe SHA-1: 905779e60144fc47f04a2722fbaa8c34a34fd91a SHA-256: b14af5abbe056c2c64955a23e4f0720a5ea251efe088a5474f8914a77a353571

130 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a common tactic for SEO poisoning and redirecting users to malicious sites. One critical heuristic identified a link to a known malicious redirector at 'https://ttraff.com/wix?keyword=atualizar+android+box+mxq'. The document body also contains a visual download button lure, further supporting the malicious intent. The presence of many links to Shopify PDFs suggests a link farm used to obscure the final malicious destination.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=atualizar+android+box+mxq
- https://cdn.shopify.com/s/files/1/0435/2904/4119/files/function_of_local_government_in_malaysia.pdf
- https://cdn.shopify.com/s/files/1/0429/5429/3402/files/jisutijumav.pdf
- https://cdn.shopify.com/s/files/1/0429/8565/2375/files/lareribiramiridesegibejin.pdf
- https://cdn.shopify.com/s/files/1/0430/8631/5682/files/lugudibanukugupavekibafi.pdf
- https://cdn.shopify.com/s/files/1/0436/9163/8934/files/zibekijuzuzinegefun.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fasexerogetotano.pdf
- https://cdn.shopify.com/s/files/1/0438/2975/6066/files/yasin_surah_file.pdf
- https://cdn.shopify.com/s/files/1/0440/4668/0214/files/frise_chronologique_mouvements_littraires.pdf
- https://cdn.shopify.com/s/files/1/0440/9756/8920/files/samojuxok.pdf
- https://static.usrfiles.com/ugd/ab63e3_d8dcc04b1d8e42f380649bd009f4a5f6.pdf
- https://static.usrfiles.com/ugd/2486b5_68a0214fe2244a5ea7744a2d3f98f485.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008860.bin` `200d80052db1252a0f75df5823825fb989509a7335484622774163e5944953e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8860	4928 bytes
`font_01_sfnt_off000098f1.bin` `a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x98F1	1800 bytes
`font_02_sfnt_off0000a17e.bin` `58dc6a1e50fc66c501c4ee06780d1e30a4f842b685314a8cb14fa89a93a8e261`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA17E	10556 bytes
`font_03_sfnt_off0000c582.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC582	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.