PDF malware analysis — malicious · b3cbf4836e07004e

MALICIOUS

PDF

45.2 KB Created: 2020-08-30 14:06:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: da496714285b7994cc8d14963bf5378a SHA-1: bc84022da325f49fc746c39a21f25a5fb04c903e SHA-256: b3cbf4836e07004e3e1fbe4206dee9b4d24f3fd3d0d3cf0764185a52ad052006

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. This indicates the document is designed to redirect users to a malicious site. The document body, though heavily obfuscated, contains the same URL and references to logic puzzles, likely as a lure. The PDF also contains a large number of external links, many pointing to 'static.usrfiles.com', which is flagged as a link farm. The SE_URGENCY_LURE heuristic suggests a social engineering tactic was employed.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=logic+puzzles+printable+puzzle+baron
- https://static.usrfiles.com/ugd/b8c837_3107dfe9b730412ba74a3e62a761ee0c.pdf
- https://static.usrfiles.com/ugd/99965f_79ca57183e7d4b5f9860c0540aba53bf.pdf
- https://static.usrfiles.com/ugd/9cc572_cc42df6b35a645549b0fd222409921cb.pdf
- https://static.usrfiles.com/ugd/b8c837_cb8444e3457a4832bae96b7ddb14674a.pdf
- https://static.usrfiles.com/ugd/2ac701_3c09c3ca864843f8a795019e056a8111.pdf
- https://cdn.shopify.com/s/files/1/0432/9183/6566/files/79885028256.pdf
- https://cdn.shopify.com/s/files/1/0434/8333/2772/files/95111599879.pdf
- https://static.usrfiles.com/ugd/a86d68_e6e73f2fa6f14ca8852234f834bdd678.pdf
- https://static.usrfiles.com/ugd/48f461_f5bc5423063344fc8c6868b73611ff1b.pdf
- https://static.usrfiles.com/ugd/8cbfce_f2db96db5de44008ba3e06332ccb0d29.pdf
- https://cdn.shopify.com/s/files/1/0432/1778/0896/files/84876657042.pdf
- https://cdn.shopify.com/s/files/1/0431/2471/9773/files/fall_out_boy_infinity_on_high_zip.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f4e.bin` `9ce59965d598362bbc7e3af4bf422cbb51366b0768f361b897da9456b2395d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F4E	5116 bytes
`font_01_sfnt_off000070c5.bin` `adc843ba24aaaafbcd756954e5336c1d9b7f69f84f9eaa11fb6581f4f64a05d0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x70C5	12888 bytes
`font_02_sfnt_off000099fc.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x99FC	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.