PDF malware analysis — malicious · b2aa3aa0fd06e676

MALICIOUS

PDF

36.9 KB Created: 2020-08-31 14:08:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fffc30fbe8c670a41e97b8016137ebe9 SHA-1: e1f9f951d73864678df3250eb0423b6e9749fe0a SHA-256: b2aa3aa0fd06e6766b1d9439f1857e6f268714f8f516120c82477b0c079a5471

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, with one critical heuristic firing indicating a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for "case files family medicine pdf google drive", directing users to the malicious URL https://ttraff.com/pify?keyword=case+files+family+medicine+pdf+google+drive. This suggests a phishing or social engineering attack aimed at redirecting users to malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=case+files+family+medicine+pdf+google+drive
- https://static.usrfiles.com/ugd/b47706_dabe0fb7e26d4c798682dee1bac098de.pdf
- https://static.usrfiles.com/ugd/e02969_093fea14ce804fc99c332da138cbffed.pdf
- https://static.usrfiles.com/ugd/b8c837_24aea0c63e874923a51c64b47926ef78.pdf
- https://static.usrfiles.com/ugd/86319b_03885813eff8403c8fafc353b8648231.pdf
- https://cdn.shopify.com/s/files/1/0432/0355/9583/files/vixojojatobojep.pdf
- https://cdn.shopify.com/s/files/1/0431/3907/2161/files/87683599647.pdf
- https://cdn.shopify.com/s/files/1/0432/9802/9733/files/dewajilonosulufi.pdf
- https://cdn.shopify.com/s/files/1/0429/4852/6246/files/nigadolixemetitidimogudig.pdf
- https://cdn.shopify.com/s/files/1/0432/9101/7374/files/23663453056.pdf
- https://cdn.shopify.com/s/files/1/0432/2436/7262/files/arjun_full_movie_santali.pdf
- https://cdn.shopify.com/s/files/1/0432/0778/6657/files/area_of_trapezium_and_polygon_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0434/2287/5797/files/vojobakakezaxal.pdf
- https://cdn.shopify.com/s/files/1/0428/1758/5308/files/49046964757.pdf
- https://cdn.shopify.com/s/files/1/0431/3884/2779/files/dipofiramafobegesin.pdf
- https://cdn.shopify.com/s/files/1/0432/3000/3358/files/97546988877.pdf
- https://cdn.shopify.com/s/files/1/0432/4959/8632/files/84716853047.pdf
- https://cdn.shopify.com/s/files/1/0463/9857/0651/files/39044548302.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004fc0.bin` `8b90b1c544086d0deaa9ecbe915897215e1457194c4a2c0bf98cdebd1b22afbd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4FC0	5540 bytes
`font_01_sfnt_off00006295.bin` `0e9a448415c480c45c617601dbda17b6e43b484ff563c46409cf6a32a9a229fc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6295	10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.