PDF malware analysis — malicious · bb3d486d7eaa58b6

MALICIOUS

PDF

70.4 KB Created: 2020-08-09 21:53:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 462b8ab853ff64a6767523d38a67d61a SHA-1: b2e8cc65176133e8f60292776d0860095c9a1a03 SHA-256: bb3d486d7eaa58b6fe9a545ef56164a4c6bb8daac293cd895e8b20e3e69172ab

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This indicates an attempt to redirect the user to a malicious site. Additionally, a large number of external PDF links were found, suggesting a link farm or SEO poisoning tactic. The document body contains the URL 'https://ttraff.com/pify?keyword=causes+of+water+contamination+pdf', reinforcing the malicious redirector finding.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=causes+of+water+contamination+pdf
- http://files.southcolbyptso.com/uploads/1/3/0/7/130739651/fuwoxes.pdf
- http://files.chinchillaphotography.com/uploads/1/3/2/7/132710784/dudiwimezefi-gukeluxodi-lifikipezufi.pdf
- http://files.khunterart.com/uploads/1/3/1/4/131453399/lukoxifosofug.pdf
- http://files.bearcreekcommunity.com/uploads/1/3/1/3/131380126/2571960.pdf
- https://cdn.shopify.com/s/files/1/0439/0119/0299/files/sewesijamob.pdf
- https://cdn.shopify.com/s/files/1/0430/4276/7001/files/94358163273.pdf
- https://cdn.shopify.com/s/files/1/0433/9118/9157/files/82615916480.pdf
- https://cdn.shopify.com/s/files/1/0429/3486/1987/files/51849215447.pdf
- https://cdn.shopify.com/s/files/1/0434/2690/6264/files/vewapirugek.pdf
- https://cdn.shopify.com/s/files/1/0433/7362/5500/files/fufitutur.pdf
- https://cdn.shopify.com/s/files/1/0427/8360/4903/files/pugukesub.pdf
- https://cdn.shopify.com/s/files/1/0447/9716/5728/files/cranial_nerves_functional_anatomy.pdf
- https://cdn.shopify.com/s/files/1/0438/4777/8469/files/buchungsstze_bungen_lsungen.pdf
- https://cdn.shopify.com/s/files/1/0433/9610/4348/files/17279008082.pdf
- https://cdn.shopify.com/s/files/1/0435/1403/6376/files/57796701147.pdf
- https://cdn.shopify.com/s/files/1/0430/9162/4097/files/lalofikagabap.pdf
- https://cdn.shopify.com/s/files/1/0435/4179/0871/files/82547211395.pdf
- https://cdn.shopify.com/s/files/1/0430/0174/1463/files/gepenudilepebatuvepi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d3a4.bin` `4ebd0f2c8df5aff4f4e23737a4499866dce232cf15b2bf68fcab26c343bc5188`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD3A4	5268 bytes
`font_01_sfnt_off0000e587.bin` `386adedaf41bacfa675a05b413c31291d24b02a43e5c7e3e0c797b3b905956fa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE587	12032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.