PDF malware analysis — malicious · c9e78ba05491eb87

MALICIOUS

PDF

41.4 KB Created: 2020-08-30 20:54:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6d2fdd51eacf6963e34b45cdcdb1a873 SHA-1: db6bccb98e4405e3bc0993832ea3e3c53094f43f SHA-256: c9e78ba05491eb874dbc70d9d8b8d63c4c9dc327f31ef183dd0042d7f0b08e07

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=elite+reclamation+audiobook'. The document body, though heavily obfuscated, appears to contain text related to an audiobook and the redirector URL. The presence of numerous external PDF links also suggests a link farm or redirection strategy. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=elite+reclamation+audiobook
- https://static.usrfiles.com/ugd/1fbf8b_bc3ffcfb153f48e6958c51067f89cbda.pdf
- https://static.usrfiles.com/ugd/b8c837_2ea3711ed59f43fa8387ef0deb4c719f.pdf
- https://static.usrfiles.com/ugd/b8c837_0f4d587ac53d4842a8a9de53f98e2172.pdf
- https://static.usrfiles.com/ugd/4f270c_ca710ab99694404f9c3a16ca57181fc7.pdf
- https://static.usrfiles.com/ugd/97aff7_2a500bb028814e72ad735973331bff75.pdf
- https://static.usrfiles.com/ugd/b8c837_4263e917e5ab430bbce7e8548f6d2abe.pdf
- https://static.usrfiles.com/ugd/b8c837_33ed2aa250824ee2b529c83309b153c1.pdf
- https://static.usrfiles.com/ugd/b8c837_31facdb28ae3470c841cfb5e3d84d451.pdf
- https://static.usrfiles.com/ugd/2074c9_1722a99bc8ff4949a342dab14efbafb6.pdf
- https://static.usrfiles.com/ugd/7dd30d_9a86aa8ec72f44db80e30e0d954cc7fb.pdf
- https://static.usrfiles.com/ugd/b8c837_cbc1905634db493a8d298520cd1781be.pdf
- https://static.usrfiles.com/ugd/ce14f3_c46f466cc743423097dbf23b50005a10.pdf
- https://static.usrfiles.com/ugd/b8c837_c4ba4d94663945188c53ab2d047448fd.pdf
- https://static.usrfiles.com/ugd/e643da_ee81c335dbc74a238fa6ca6cf439251e.pdf
- https://static.usrfiles.com/ugd/b8c837_3d1bd5baa19547078d6a8cbcd280e828.pdf
- https://static.usrfiles.com/ugd/5360f8_be6cbf75b93e416183f18f522ceaf649.pdf
- https://static.usrfiles.com/ugd/fd3290_849260e9f727411bb4a94b305a075ef4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005b31.bin` `0688ec0e1394bd265087ead0441939ca6b685e5a3b704604b6fbc17c8dd72469`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B31	5068 bytes
`font_01_sfnt_off00006c46.bin` `e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C46	1800 bytes
`font_02_sfnt_off000074d4.bin` `a13da208b0279c973fe9ec72357fa8b33c7ffd563fd91514f5912931b07382f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x74D4	10300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.