PDF malware analysis — malicious · c549b32731081b11

MALICIOUS

PDF

45.8 KB Created: 2020-08-31 07:53:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 922b7dd813a978154add5c3167cccb82 SHA-1: c87a678d764b5b830f96cb1c96b568c64e162997 SHA-256: c549b32731081b111118d1ac33c8601dd4688c236e81024c96a5d39eddeab894

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a lure promising a personalized astrology chart interpretation. It embeds numerous links, with one critical heuristic identifying a link to known malicious redirector infrastructure (ttraff.cc). The document body, though heavily obfuscated, contains this URL and other links to static.usrfiles.com, which appear to be part of a link farm designed to improve search engine ranking for malicious content. The primary attack vector is social engineering via a deceptive link.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=my+astrology+chart+interpretation In PDF document text
- https://static.usrfiles.com/ugd/0b46e6_423beb8674cb44cf909cae9caa7947eb.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_4b90efcf3d364fdf8a2a72e895831b98.pdfIn PDF document text
- https://static.usrfiles.com/ugd/9ea9b6_f7ffa8b825f1470297ea65b5bb7aee50.pdfIn PDF document text
- https://static.usrfiles.com/ugd/8ba634_6b3d9a8360f54f84a5a16917742815b6.pdfIn PDF document text
- https://static.usrfiles.com/ugd/e73fea_f726441f46c4402ea0a1103a4abfa5ff.pdfIn PDF document text
- https://static.usrfiles.com/ugd/77d535_285818b81eaa48a5b04d8076dc5cdc74.pdfIn PDF document text
- https://static.usrfiles.com/ugd/bb13a2_7f9e15fc612040a0beeb609176da4191.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_c9b8e2d6641343489e16d1e6645c7033.pdfIn PDF document text
- https://static.usrfiles.com/ugd/5b604d_36a71eae39fd4a8384105e2eadf6ee6e.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_52bb319913b542cbaa5eee536e66732a.pdfIn PDF document text
- https://static.usrfiles.com/ugd/269bb8_1ceb24294bf54656abb5a75b7251b974.pdfIn PDF document text
- https://static.usrfiles.com/ugd/1be480_a4a987c99f044920b1e56d9d42dce80d.pdfIn PDF document text
- https://static.usrfiles.com/ugd/3aee12_7c920fcb98bd4bcf8abcb658a8ad5a6d.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/9378/6791/files/deezloader_remix_4._2._1.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0465/4769/7814/files/bodoji.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/7573/9560/files/the_greatest_showman_lindsey_stirling_sheet_music.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/4818/9603/files/17451746493.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006679.bin` `5c0d469328b83c360319fe6956f1181fea38b23a1371e5df135ffa399f943bf0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6679	5088 bytes
`font_01_sfnt_off000077c6.bin` `912a4273a53f9cde8dc3b1cff3b2e8d5619b329193830c6d11c86e341ccea33c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77C6	10564 bytes
`font_02_sfnt_off00009b9b.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9B9B	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.