PDF malware analysis — malicious · b88f7824fde0d638

MALICIOUS

PDF

40.3 KB Created: 2020-09-01 15:25:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 17ba0b3ef0e01eb83085fbe5b4d5d434 SHA-1: 2f2f9c75afae26c3ab6295fe335e9b2b79a223bc SHA-256: b88f7824fde0d6380cbc3a5a99ac8f3437d2a0ff199b9ed59265f18e5069fb99

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1566.002 Spearphishing Attachment

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. The document also contains a high-confidence heuristic for a password-protected archive lure, suggesting the user is prompted to download an encrypted payload. The presence of numerous links to external PDFs, many hosted on static.usrfiles.com, indicates a link farm designed to improve search engine ranking for terms like 'winrar free 64 bit crack'. No scripts were extracted from this sample.

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=winrar+free+64+bit+crack
- https://static.usrfiles.com/ugd/e2c6c1_c0b6a235920145f7b232f4c8c4890f70.pdf
- https://static.usrfiles.com/ugd/b85eb0_6c0041293a234000b28ec03282fa8e51.pdf
- https://static.usrfiles.com/ugd/badafb_9dc36604d3cf4fe1836f8937811571ba.pdf
- https://static.usrfiles.com/ugd/b8c837_de82ef8dd8774e5a86d629f3711181a5.pdf
- https://static.usrfiles.com/ugd/b8c837_e28ad10048174f96ad44a077dbc55c73.pdf
- https://static.usrfiles.com/ugd/b6edda_d3aecb3faa1a48bc8b81f9c0a5eddc6c.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/lafiku.pdf
- https://cdn.shopify.com/s/files/1/0438/8506/8456/files/beludojikovenoxize.pdf
- https://cdn.shopify.com/s/files/1/0427/5788/2022/files/zurifeminixuridol.pdf
- https://static.usrfiles.com/ugd/1cfe37_4f0691aace124fbea8cc1b17fcf5258a.pdf
- https://static.usrfiles.com/ugd/b8c837_e61ca8ca5bbe4d16a1c09b3faeaadb92.pdf
- https://static.usrfiles.com/ugd/5cf23b_5c5a71ff72e84d5c91bc9a57c46c894f.pdf
- https://static.usrfiles.com/ugd/77941b_8ab8e6e5851248d79da42db42bff7112.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f2d.bin` `60d1ec621d437155ac280cd8169e47877a980754a89a7a14ea0d3b83598f3df6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F2D	5124 bytes
`font_01_sfnt_off000070c5.bin` `dee3717ab92c951287fa1a754b49fcae12022bb25b38ca02e45d10a9d99a9fda`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x70C5	10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.