PDF malware analysis — malicious · bc10669cb14cbf83

MALICIOUS

PDF

46.2 KB Created: 2020-08-30 10:14:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 56b61e6e2f47f8b966bad5cef136ecb4 SHA-1: 3e7275c3976a2cb4ce8fca8c99b50400e696ab22 SHA-256: bc10669cb14cbf8307a2529b5fc031c68e18209aa613352d4358081ccff2deee

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=a+guide+to+critical+thinking'. This URL is embedded within the document body, suggesting a social engineering attempt to trick the user into visiting a potentially harmful site. The file also exhibits characteristics of a link farm, with numerous embedded links to external PDFs, further supporting the malicious intent.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=a+guide+to+critical+thinking
- https://static.usrfiles.com/ugd/bfbc46_7515efd4dbbf4a3e82130ac0c76fe9f9.pdf
- https://static.usrfiles.com/ugd/87a178_29b2ee799b724b679837fa4892ec3fa3.pdf
- https://static.usrfiles.com/ugd/b8c837_85c7820eb54844d08260ac1d8828e10a.pdf
- https://static.usrfiles.com/ugd/cbe7f7_5538c1b3b38743be962eb3267f8a5d1c.pdf
- https://static.usrfiles.com/ugd/9e41f0_e80386eca834437a9d996408c208682a.pdf
- https://static.usrfiles.com/ugd/97aff7_5e16f0cbb3eb42f993eef80a2307243f.pdf
- https://static.usrfiles.com/ugd/b8c837_09334912cfe84fe58a2eb31cacd0fefb.pdf
- https://static.usrfiles.com/ugd/b8c837_dfc587d6c35a4f17877ed0369fc95c21.pdf
- https://static.usrfiles.com/ugd/b8c837_f241eb9db7644141ace89f25ad2568df.pdf
- https://static.usrfiles.com/ugd/314c35_0dcf7d4b89a04fbe85614349a1b063a1.pdf
- https://static.usrfiles.com/ugd/6cfc61_406475a31ff140e3aa39a232d537b706.pdf
- https://static.usrfiles.com/ugd/b8c837_5dde3a44ed914e58b6b93f4e6e5b3cbe.pdf
- https://static.usrfiles.com/ugd/6cf0f5_0bb239ea089f492b85c676b9ef0aecd4.pdf
- https://static.usrfiles.com/ugd/26481d_b4adc61b6c29412891f6345764509493.pdf
- https://static.usrfiles.com/ugd/39cb9d_f59e1d82a76449e687d2fa43c04f1147.pdf
- https://static.usrfiles.com/ugd/b8c837_25bc10c4aeab49bfb623038ca7ad96a6.pdf
- https://static.usrfiles.com/ugd/b8c837_b9dcbb7440464f94805d8184ef6f772f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000078cf.bin` `65096048381e268281fa1e1172dcbc00debe935576d5a03dcd818c80c61a48dc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78CF	5076 bytes
`font_01_sfnt_off00008a00.bin` `b30fd03880ae561312e5c5295373a118d30c620fb878c890613910ea98c576d5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A00	9980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.