PDF malware analysis — malicious · c6bc597efd5848a3

MALICIOUS

PDF

45.1 KB Created: 2020-09-02 19:01:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7516a09bfe3a4f5895d322a830bf5d97 SHA-1: 07244d4595ccadc2e355f565b37d9081a5f50bf1 SHA-256: c6bc597efd5848a35cb3361748afeaa9430f94e9e36d68267511b48be57163ad

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous embedded links, with a critical heuristic identifying a malicious redirector. The primary link, 'https://ttraff.com/wix?keyword=us+news+world+report+college+rankings+2019', is likely used to obscure the final malicious destination. The document body, though heavily obfuscated, contains this URL and other links pointing to static.usrfiles.com, which are flagged as a link farm. This suggests a social engineering attempt to drive traffic to malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=us+news+world+report+college+rankings+2019 In PDF document text
- https://static.usrfiles.com/ugd/fdee49_e67216503d9948f097da21f4aeb6dca7.pdfIn PDF document text
- https://static.usrfiles.com/ugd/afe78f_4a51e4f9949c4e7c80ebbe13e0e30806.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_7561fce18c124605ba7d43927f70ad2c.pdfIn PDF document text
- https://static.usrfiles.com/ugd/cacfd7_dafd8e61de4c4d49a441c60b53a7ba15.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_b9a69bcc4ee8492594ddbdeac6519153.pdfIn PDF document text
- https://static.usrfiles.com/ugd/bca722_def2ac40b50345ff990bf0f31dec6f72.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_de519511f77a4c08a3ccf7fc9737d993.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_8d791ac1433d47b5ae15dd4042e1d47c.pdfIn PDF document text
- https://static.usrfiles.com/ugd/6e13d9_29396907a2c744ac9352643697ca7edd.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_0252aac7b25f41178d4ae09497bf6393.pdfIn PDF document text
- https://static.usrfiles.com/ugd/dd6616_0bad92f3326545708c5c1ace7d1ee16a.pdfIn PDF document text
- https://static.usrfiles.com/ugd/eda9ba_dfe90fdeb5644262a47895cfaeb07873.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000624e.bin` `2e9212b480a88aba165bbc56e8f6942a8e443edbaf3ee4b7525263bbea080abb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x624E	5660 bytes
`font_01_sfnt_off000075b9.bin` `7ab29ac2d631423553f7a2106206898aae2190b90bf7a1b4fd51c396df384f30`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75B9	10440 bytes
`font_02_sfnt_off00009982.bin` `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9982	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.