PDF malware analysis — malicious · b4c581ee299f9ead

MALICIOUS

PDF

102.6 KB Created: 2020-08-28 07:38:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8d6bf8d2b7b6baee1dc7ce2811b7148c SHA-1: c34167f0dee9e6b9d0fddf93a26b59dedb30c95a SHA-256: b4c581ee299f9eadc1e555d655470526fa5bc2526dbd9a35ab61dced735a7024

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a mass of external links, including one to a known malicious redirector at ttraff.com. The document body, though heavily obfuscated, contains the URL 'https://ttraff.com/pify?keyword=syntactic+structures+in+english', suggesting a lure to a phishing or malware distribution site. The presence of numerous Shopify-hosted PDF links indicates a link farm strategy, likely to improve SEO for malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=syntactic+structures+in+english
- http://files.socaldevo.com/uploads/1/3/0/7/130739268/wogak-zuwamu-seteb-fefazosufuv.pdf
- http://wafogo.custercadet.com/uploads/1/3/0/8/130874426/c556d2bc7d14e.pdf
- http://depagojan.fayettemaine.org/uploads/1/3/1/6/131636612/8d015.pdf
- http://files.weareawebsite.com/uploads/1/3/2/7/132740285/vaxipijuwo.pdf
- http://siwow.redlandseniorcenter.org/uploads/1/3/1/6/131606490/rijawogev.pdf
- https://cdn.shopify.com/s/files/1/0433/6815/3253/files/fasa_star_trek_rpg.pdf
- https://cdn.shopify.com/s/files/1/0437/0700/7141/files/the_mr_mc_rule_applies.pdf
- https://cdn.shopify.com/s/files/1/0433/5868/3291/files/48033448335.pdf
- https://cdn.shopify.com/s/files/1/0432/6536/0034/files/91157468066.pdf
- https://cdn.shopify.com/s/files/1/0430/7792/7072/files/86344953774.pdf
- https://cdn.shopify.com/s/files/1/0437/0857/9993/files/45500370371.pdf
- https://cdn.shopify.com/s/files/1/0429/9105/9097/files/julipavosuf.pdf
- https://cdn.shopify.com/s/files/1/0463/0183/9517/files/23122379327.pdf
- https://cdn.shopify.com/s/files/1/0433/8850/2174/files/wegigedufizozaxu.pdf
- https://cdn.shopify.com/s/files/1/0433/8361/9738/files/invitation_card_template_for_wedding.pdf
- https://cdn.shopify.com/s/files/1/0436/2603/7411/files/ben_10_video_game.pdf
- https://cdn.shopify.com/s/files/1/0433/6415/5560/files/14428790572.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000136d6.bin` `767d668ac120f5c763da3761d4943482717b4ef7bfcdac32bcafa9a914b553f2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x136D6	5516 bytes
`font_01_sfnt_off000149f5.bin` `5755f5e313bf3e6d2e243ca774b045f828829ce0de5be369c7b2950612912a32`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x149F5	5268 bytes
`font_02_sfnt_off00015bd2.bin` `26736063d6235bb1bdc44f4b3a2bcbcfabea7a69edc1664964d6f78ab8ed0959`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15BD2	15836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.