PDF malware analysis — malicious · b45b60fb1ead9a42

MALICIOUS

PDF

41.5 KB Created: 2020-08-30 22:06:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66bf6fa3954a27a40a348edf057043f9 SHA-1: 470f79761a1bab6cf5a5e2cdb05c1f061eda65cf SHA-256: b45b60fb1ead9a42403bce24e7232a86b5d9170cb731f63848121aaf3f812d8b

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is likely intended to lead the user to a malicious site. The document body text, though heavily obfuscated, contains the phrase 'The odyssey part 2' and the malicious URL, suggesting a lure. The presence of numerous other PDF links, many hosted on Shopify, indicates a link farm strategy, likely for SEO poisoning or to obscure the final malicious destination.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=the+odyssey+part+2
- https://cdn.shopify.com/s/files/1/0428/9314/8313/files/85825316825.pdf
- https://cdn.shopify.com/s/files/1/0437/8014/5313/files/55198493538.pdf
- https://cdn.shopify.com/s/files/1/0435/8098/1403/files/vimuwawapitawanot.pdf
- https://cdn.shopify.com/s/files/1/0432/4953/3088/files/15493762007.pdf
- https://cdn.shopify.com/s/files/1/0453/8423/7224/files/roxojuzagufe.pdf
- https://static.usrfiles.com/ugd/bfbc46_e764ea9c1b3e4334811f83246109077e.pdf
- https://static.usrfiles.com/ugd/b8c837_77c975ca356f4feab207798eb7a5a9c0.pdf
- https://static.usrfiles.com/ugd/3826db_f3ebed212e1b4029a0e983112957cec6.pdf
- https://static.usrfiles.com/ugd/b8c837_71122891b4c64d9488dcbdef0f8eca2c.pdf
- https://static.usrfiles.com/ugd/b8c837_8020b6860bac419db635f81211f85c92.pdf
- https://cdn.shopify.com/s/files/1/0437/2260/4695/files/cancer_sarcoma.pdf
- https://cdn.shopify.com/s/files/1/0438/2438/2114/files/giduvoxen.pdf
- https://cdn.shopify.com/s/files/1/0434/3991/5164/files/19378741836.pdf
- https://cdn.shopify.com/s/files/1/0437/2021/2645/files/candidiasis_bucal_pediatria.pdf
- https://static.usrfiles.com/ugd/b8c837_07b7e67539e94b319f124c84ebc7e973.pdf
- https://static.usrfiles.com/ugd/b8c837_7edd44ac085d4c6fa20bd1fb0a4a616f.pdf
- https://static.usrfiles.com/ugd/b8c837_ef293696e40146b081cc655ead63f4dd.pdf
- https://static.usrfiles.com/ugd/b8c837_bb2dab041f91476bbe2e1167e20a9945.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006780.bin` `c0b00ec8f392b0e6101dcae19e429009717e6f106cffc095fd1d69aea66e1edc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6780	5200 bytes
`font_01_sfnt_off00007933.bin` `9edc44522386b4cf0e322fd030c117f38d66990d1b8bbbbf5225f5014fa988a2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7933	9392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.