PDF malware analysis — malicious · be7629d2441a94b9

MALICIOUS

PDF

38.7 KB Created: 2020-08-30 15:27:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 58969cde8b3484adfcd670fafae50486 SHA-1: 4722b40251aace6c0397e9e203bb79c571e734d1 SHA-256: be7629d2441a94b90c56f6ff39ddba4f99007cfd536223abcf43d44025e67e5f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link pointing to ttraff.com. The document body, though heavily obfuscated, contains text that appears to be a lure for downloading music, specifically mentioning 'August alsina bandz mp3 download'. This link likely leads to a malicious site or further download. The file also exhibits characteristics of a PDF link farm, with numerous embedded URLs, suggesting a broad distribution attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=august+alsina+bandz+mp3+download
- https://static.usrfiles.com/ugd/b8c837_d5910a8b2efe4dafa99e18bd97a813a8.pdf
- https://static.usrfiles.com/ugd/b8c837_6fab0fb2f8284ee8a177317f2dddbf43.pdf
- https://static.usrfiles.com/ugd/f0e51d_8751cde3f1b34698a641514149262799.pdf
- https://static.usrfiles.com/ugd/b8c837_8d2b3070a139414cae34f2523698b6a9.pdf
- https://static.usrfiles.com/ugd/b8c837_dfe136bcdc9e448dbf4c3a112f7ebd87.pdf
- https://static.usrfiles.com/ugd/67e251_cd65e4761cf2436c8dea0e3f2f3c6f69.pdf
- https://static.usrfiles.com/ugd/89c6ad_bb5c0b38f1ad4feebeb47676109575a9.pdf
- https://static.usrfiles.com/ugd/b8c837_af46178635b24690bcc99f6758291b71.pdf
- https://static.usrfiles.com/ugd/b8c837_4888ca9a04c847228ff20eebe8ea2965.pdf
- https://static.usrfiles.com/ugd/b8c837_bc3117f1577f416aa34490a5af1601f2.pdf
- https://static.usrfiles.com/ugd/e33828_7bf86d263d5240cf8d34324ad68e8033.pdf
- https://static.usrfiles.com/ugd/b8c837_e7493162631d4435b092bae9165f26ed.pdf
- https://static.usrfiles.com/ugd/cc14e4_c641e79868ad4f17a5182894497b7c40.pdf
- https://static.usrfiles.com/ugd/286fb8_990d2db98d974dd9b74e0870a86aa3b0.pdf
- https://cdn.shopify.com/s/files/1/0428/3016/8230/files/lonely_planet_japanese_phrasebook.pdf
- https://cdn.shopify.com/s/files/1/0433/9105/8083/files/vibodusof.pdf
- https://cdn.shopify.com/s/files/1/0436/2970/7422/files/nixaxatilawarowado.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000056d9.bin` `a83fb05209771d1c04641fa99309a6d99ab19ccdbecac62b085726b2ff0cb7de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x56D9	5616 bytes
`font_01_sfnt_off000069f0.bin` `7655d6b10e9863caecca4fe3c44d1e64e22785a3baa4fb730500535b8180b7ec`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69F0	10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.