PDF malware analysis — malicious · c1ffc8a1dcc63b6c

MALICIOUS

PDF

41.6 KB Created: 2020-09-02 09:22:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0779469d67b31359445d93be33e755be SHA-1: 22d0b66097cea1057667804a8065912bcbbbab2b SHA-256: c1ffc8a1dcc63b6c482dee925ed656c8b1622b61b56e7e25c71677729bd02b03

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a malicious redirector link pointing to 'ttraff.me', which is designed to lure users into clicking through to a potentially harmful destination. The document also exhibits characteristics of an MFA or one-time code harvesting lure, suggesting a phishing attempt. The presence of a mass external PDF link farm further indicates malicious intent, likely to obscure the true destination or to distribute further malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=spreadsheet+view+android+github
- https://static.usrfiles.com/ugd/b8c837_57f22b90c1c349beb4dee70e8a6f115d.pdf
- https://static.usrfiles.com/ugd/b65acf_5096f7c57f0d4fa5926c134a39f5a775.pdf
- https://static.usrfiles.com/ugd/7e0eb0_15906a51f25440569af527d410f8ef42.pdf
- https://static.usrfiles.com/ugd/0e9fc2_2a3c9ca3efa14878962f7d3e12baf1e4.pdf
- https://static.usrfiles.com/ugd/b8c837_0ee15c71424e44d187b68df8108ce067.pdf
- https://cdn.shopify.com/s/files/1/0427/7652/7014/files/53835481119.pdf
- https://cdn.shopify.com/s/files/1/0429/7300/3939/files/fidimupedovavajujudeb.pdf
- https://cdn.shopify.com/s/files/1/0438/0504/8989/files/minecraft_mmorpg_server_with_classes_and_quests.pdf
- https://static.usrfiles.com/ugd/e0d0cf_79c24af59b6249d58037fac1ce53eef8.pdf
- https://static.usrfiles.com/ugd/b8c837_eb2c15093a80485a9d851f595bd3b2e4.pdf
- https://static.usrfiles.com/ugd/a76634_0ab9175de50845dc939c4f98fcc205ca.pdf
- https://static.usrfiles.com/ugd/b8c837_15391b1509634ac7be1bed88aeae6e23.pdf
- https://static.usrfiles.com/ugd/696b8a_7ef100f6734644a28392ee8c60e95d62.pdf
- https://static.usrfiles.com/ugd/95089d_a5eb4b94ff7f4c65ba653cdb469a5072.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006010.bin` `edd4810f9034af04067e6241e19b86908856298a96308d72c2d61837fc36ae05`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6010	5584 bytes
`font_01_sfnt_off00007315.bin` `f6e666ceb9f44ded7fa71f524a54321c647adf84dbb6459950440f0ee2f10644`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7315	11552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.