PDF malware analysis — malicious · b63ab1cc66f3905c

MALICIOUS

PDF

51.0 KB Created: 2020-08-04 20:59:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3c9ebd864aa26291480e51c5b0b1fee1 SHA-1: 4156459f4207645b539711ffa49345eef1d36884 SHA-256: b63ab1cc66f3905cd3fde485c3777ac204374801760e5fb98f56177372be4432

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a redirector ('ttraff.cc') which is flagged as malicious. It also exhibits characteristics of a link farm, embedding numerous URLs, many of which point to Shopify-hosted PDFs. The document body, though heavily obfuscated, contains the malicious redirector URL. The primary attack pattern involves tricking the user into clicking the malicious link, likely leading to a further stage of infection.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=nerd+fitness+bodyweight+pdf
- http://files.trudietrewin.com/uploads/1/3/0/7/130775730/xurof.pdf
- http://files.proofreading-course.com/uploads/1/3/1/3/131379253/vifijabu.pdf
- http://files.whiteglovetreatmentllc.net/uploads/1/3/0/8/130815026/xorubulot_kemuzemetar_dokizapi_nopoke.pdf
- http://files.nottingham-north.org.uk/uploads/1/3/2/7/132740978/xosixak_tisotopij_jepaf_basap.pdf
- https://cdn.shopify.com/s/files/1/0431/6200/9755/files/71387884245.pdf
- https://cdn.shopify.com/s/files/1/0430/8277/6725/files/jilobakanagek.pdf
- https://cdn.shopify.com/s/files/1/0433/8407/8503/files/tamonisabefufu.pdf
- https://cdn.shopify.com/s/files/1/0430/1452/0995/files/punosedukazenapezi.pdf
- https://cdn.shopify.com/s/files/1/0437/7565/6094/files/bamebotig.pdf
- https://cdn.shopify.com/s/files/1/0435/9133/6099/files/930257614.pdf
- https://cdn.shopify.com/s/files/1/0430/8631/5671/files/vopotuxefigexo.pdf
- https://cdn.shopify.com/s/files/1/0437/5638/8510/files/rijogiwotuxidexujufu.pdf
- https://cdn.shopify.com/s/files/1/0434/9798/0056/files/72827400636.pdf
- https://cdn.shopify.com/s/files/1/0435/8068/6491/files/zaragazolalesimizo.pdf
- https://cdn.shopify.com/s/files/1/0429/0979/4463/files/18744354799.pdf
- https://cdn.shopify.com/s/files/1/0432/5248/2208/files/42967018907.pdf
- https://cdn.shopify.com/s/files/1/0436/2692/2146/files/2001_chevy_monte_carlo.pdf
- https://cdn.shopify.com/s/files/1/0440/9645/4808/files/rinabas.pdf
- https://cdn.shopify.com/s/files/1/0435/0246/9285/files/182113885.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000886b.bin` `fcc48720802d4ab4bc91e90c3ddf5691603672154c73040e0e34c1fc844f0ec2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x886B	5364 bytes
`font_01_sfnt_off00009ac7.bin` `6975174277b44b7aac275e8c7328a99bc3c9ff550253cae3e1ed75d1e368ac10`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9AC7	10516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.