PDF malware analysis — malicious · b6084f02b8310225

MALICIOUS

PDF

40.3 KB Created: 2020-08-30 13:24:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 705fdb13e29f65fa94ed6e19a1a96c3f SHA-1: 8ddfb269d2e6a3b08f3b42cecbfaae78cecdf575 SHA-256: b6084f02b83102250d4df547555382764678d7c695f04c1dd7c2ad701133743c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text fragments that appear to be a lure related to 'Dark side of the moon mp3'. The primary malicious indicator is the redirection to ttraff.com, which is flagged as malicious. The file's structure suggests it's part of a link farm designed to distribute malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=dark+side+of+the+moon+mp3
- https://static.usrfiles.com/ugd/b8c837_97f6b10ce3454c0db85ad522e47a3c50.pdf
- https://static.usrfiles.com/ugd/b8c837_0ad5dce24a5841b0bfda3ac696c1c899.pdf
- https://static.usrfiles.com/ugd/b8c837_288914f264e44faca53a812c5ca2abdf.pdf
- https://static.usrfiles.com/ugd/5d2cf3_6c271f5b3a4b4e969896d37d156305e3.pdf
- https://static.usrfiles.com/ugd/11f207_e4f6d23ac0f14bfa96b92868bce3ed91.pdf
- https://static.usrfiles.com/ugd/ec0c41_e47b5d06c1ec46f3840eca6c620124e2.pdf
- https://static.usrfiles.com/ugd/b8c837_e11e319da3e944ceb21665370faddd39.pdf
- https://static.usrfiles.com/ugd/314c35_b4530283190e4b4fa8c0961fa4fd497e.pdf
- https://static.usrfiles.com/ugd/b8c837_76881a6c76af480785f015fecb06af56.pdf
- https://static.usrfiles.com/ugd/6cfc61_afad70783e6f4ef89a25308a6e33d68f.pdf
- https://static.usrfiles.com/ugd/b5aed9_8eff698678bf477b89c113903a22dcee.pdf

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004941.bin` `ab8013dcf2a2f85d53033acad26d2f9fd3bcaf9b9af37c2786c8ddcfb8724abb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4941	6664 bytes
`font_01_sfnt_off00005fed.bin` `b8e7fff75dd2d34bb8aacceb6ef20d1e44091c780180e907284ff61a7186bb9e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FED	5476 bytes
`font_02_sfnt_off0000726d.bin` `621e55088af6bdbe2e2f9a512293e9d73dfd99b2592379797dc3e18451381da9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x726D	13820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.