PDF malware analysis — malicious · b68c052818789181

MALICIOUS

PDF

46.7 KB Created: 2020-08-30 16:00:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 564da0f7f5bea895adfddd680739c132 SHA-1: ab3258dd3c481faefdd0078b8923bb1a4a33fe59 SHA-256: b68c052818789181fb6fee5e551e08edcdf5c9d7a879ce34722b5df334e40fab

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.link/wix?keyword=ejemplos+de+densidad+en+la+vida+cotidiana'. Additionally, another critical heuristic indicates a PDF link farm, suggesting the document is part of a larger SEO manipulation or malicious redirection scheme. The document body, though partially corrupted, contains the same URL, reinforcing its role as a lure. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=ejemplos+de+densidad+en+la+vida+cotidiana
- https://static.usrfiles.com/ugd/bdeb4c_da76bf2a914045749fb600195d8e92fd.pdf
- https://static.usrfiles.com/ugd/96768c_626eba5c6f6b4ce286f2fd45850e5840.pdf
- https://static.usrfiles.com/ugd/30e015_b42b159b9c9a4dcbb0712405759ae1e7.pdf
- https://static.usrfiles.com/ugd/0a0016_d63034c42a5447ddb03d5e2e345ad885.pdf
- https://static.usrfiles.com/ugd/704566_9ef4a822e87543adbd7cc0cadddb034c.pdf
- https://static.usrfiles.com/ugd/b8c837_570843dfa00848aa8f001642ff081495.pdf
- https://static.usrfiles.com/ugd/0ebc1f_e1d8d540e774467b87b462293c9d0b1d.pdf
- https://static.usrfiles.com/ugd/0dd040_e4a169b5942f44a18a8b9b27a04bec75.pdf
- https://static.usrfiles.com/ugd/3f80ec_da4040f515d74db59a7e0e538e80388b.pdf
- https://cdn.shopify.com/s/files/1/0437/3646/5559/files/4619213663.pdf
- https://cdn.shopify.com/s/files/1/0434/2513/6797/files/apocalpticos_e_integrados_gratis.pdf
- https://cdn.shopify.com/s/files/1/0438/0708/0605/files/dafulitibaturokebe.pdf
- https://cdn.shopify.com/s/files/1/0429/3174/9031/files/fire_emblem_awakening_art_book.pdf
- https://cdn.shopify.com/s/files/1/0431/5090/1402/files/pazunagefafenobebuxoti.pdf
- https://cdn.shopify.com/s/files/1/0436/5955/9065/files/21081255963.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006aa3.bin` `44a0fcffb32099ec90753c51e421340b132bb8e3db53cf28802b740e9c18801e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AA3	5004 bytes
`font_01_sfnt_off00007b95.bin` `c98ffbe2ddb4df04b2550e64de5f434902cebeac941eb6e33f322a069e0f7937`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B95	11132 bytes
`font_02_sfnt_off00009f6e.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9F6E	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.