PDF malware analysis — malicious · c2dd2003e547d57f

MALICIOUS

PDF

40.7 KB Created: 2020-09-20 23:46:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6fe4ff43927d868272b7abefffd3447c SHA-1: 507e7226c93021ff39d8ca0babb06ac8160c5f13 SHA-256: c2dd2003e547d57fa3cebe89f2c38918c5959741c23e1e9c67541089f323d36e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a redirector service. The primary malicious URL identified is https://ttraff.link/wix?keyword=quadratics+take+home+test+answers, which is likely used to direct users to a malicious site. The document body, though heavily obfuscated, contains references to academic content, suggesting a lure to entice users to click the malicious links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=quadratics+take+home+test+answers
- https://8c75b151-714b-4dd0-b569-7e855491cbf4.filesusr.com/ugd/9cb112_30111fc9ed794e919bb962a1e32bf496.pdf?index=true
- https://ec943db3-de5e-40b1-8a14-53234949d1a8.filesusr.com/ugd/762c1a_c94fc191b292475087368099309b22c0.pdf?index=true
- https://66e28086-7132-447b-9a93-559424a36276.filesusr.com/ugd/ab0441_3716dd5080ad4c47b41e1b87e52c9e59.pdf?index=true
- https://a011f6ff-68f6-4e60-86ff-23e4fdf312de.filesusr.com/ugd/64f9d2_841695e8e3154a9bbc65af1397aac742.pdf?index=true
- https://df3a8894-f9b4-4b28-be1b-71795b5fce7c.filesusr.com/ugd/d38238_9a479ed5425d406d853d9a836a5266f5.pdf?index=true
- https://092f17db-35fb-4a7b-a04d-0e4e795c9fb0.filesusr.com/ugd/cf9ff1_797feeeaffa44cad96f1450c2d084449.pdf?index=true
- https://d48de010-c4d3-4e58-be8b-ef248172bbe0.filesusr.com/ugd/a86d68_887ab8f728954a6fafd2aa676538f9f8.pdf?index=true
- https://b8c2a0ca-2204-4d33-aa9b-ad0f28f4f49b.filesusr.com/ugd/e2b09b_6ba15bb481b54f7cb323ba2ec9dec4f9.pdf?index=true
- https://ffcb9655-d4ec-4067-8da5-9315c4092688.filesusr.com/ugd/856cea_514fd30bede64217bea58530203a2a7b.pdf?index=true
- https://06662103-dafe-4aaf-9b0c-1ff2e660b8bb.filesusr.com/ugd/bca722_f7bf57b58ac64e39984c12c8fafba6d7.pdf?index=true
- https://cdn.shopify.com/s/files/1/0435/2537/4103/files/88247836467.pdf
- https://cdn.shopify.com/s/files/1/0460/2331/1519/files/25700901904.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/72707516801.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f0b.bin` `633a60d6af9761996ecce96bebdd20ccc0fc77efcb31258693ea5f645fc9c9fb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F0B	5364 bytes
`font_01_sfnt_off0000712e.bin` `a6231aab841a31ff5fe59d7fa760f61b7254a75f399b0204274339b238391f5d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x712E	10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.