PDF malware analysis — malicious · c3bc36aec65dccbf

MALICIOUS

PDF

42.8 KB Created: 2020-09-03 11:18:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 835be03ba0066ed732b2d1872b457831 SHA-1: 7ed0d40701e9fb8da04e5fa0863821377fc59235 SHA-256: c3bc36aec65dccbf64fbbc5340268374adab49ba4c93bf8cd603c6b2ecbbfa8f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=transformation+of+log+functions+worksheet'. It also exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs. The document body, though heavily obfuscated, contains the same redirector URL and references a 'Transformation of log functions worksheet', suggesting a lure to disguise the malicious intent. The primary attack pattern involves redirecting the user to a malicious site.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=transformation+of+log+functions+worksheet
- https://static.usrfiles.com/ugd/b8c837_0dcf7ec2b9304b93a502b2df4ea6278d.pdf
- https://static.usrfiles.com/ugd/3bca44_a04a0dc132574c66bb0a0c43f7a9a0d5.pdf
- https://static.usrfiles.com/ugd/08e331_a3dec058626b4e11b4679099b68e0d30.pdf
- https://static.usrfiles.com/ugd/89602e_cc44bfba9fce464fadce0857b1040862.pdf
- https://static.usrfiles.com/ugd/2f3ac6_ead53c1e3ba64d7cb16792116fb2c0cf.pdf
- https://static.usrfiles.com/ugd/b8c837_b4b93246178f46e9b081eaf22ff6d379.pdf
- https://static.usrfiles.com/ugd/740d8c_593d74a0f2cc4d6bbc92388b90155871.pdf
- https://static.usrfiles.com/ugd/269bb8_08848ccdd3d7434d8b4e8159128e9d06.pdf
- https://static.usrfiles.com/ugd/74c34a_e0f88c636ee14b8bb3ec8254431c4d90.pdf
- https://static.usrfiles.com/ugd/9219f8_ced5600da1e14febb80188d698d8b613.pdf
- https://static.usrfiles.com/ugd/9ef0c3_e04b933e9eef402ca8bf1e6a45f55238.pdf
- https://static.usrfiles.com/ugd/d775a9_4b2db65554d5445daceed80b3fc809ae.pdf
- https://static.usrfiles.com/ugd/804ff6_d30ad1efe8dc4a028fd78fb4fdff8048.pdf
- https://cdn.shopify.com/s/files/1/0433/4285/6344/files/72052722090.pdf
- https://cdn.shopify.com/s/files/1/0433/4492/0734/files/aflame_penelope_douglas_download.pdf
- https://cdn.shopify.com/s/files/1/0437/5959/9777/files/start_a_riot_shaboozey.pdf
- https://cdn.shopify.com/s/files/1/0433/7431/3622/files/54363953718.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006813.bin` `472785c7da2745ef5819daecd5b2332d99bd8c293d06de13c89758723b8b6f16`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6813	5400 bytes
`font_01_sfnt_off00007a5e.bin` `7056d55318a431daf759a28c53c3122b5e1521add6799682db8fc18eb12e69bd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A5E	10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.