PDF malware analysis — malicious · cb12cf422ff2d5e6

MALICIOUS

PDF

41.8 KB Created: 2020-09-17 19:13:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8686e43d4f3579c776425bb97df66721 SHA-1: 4e855a15f54121d7c60c28083492ea7d700bd542 SHA-256: cb12cf422ff2d5e692c910ac675fbd7f6759b5806ab68725aa5f7a821e9be238

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, including a critical link to a known malicious redirector at 'ttraff.club'. The document body, though heavily obfuscated, contains the URL 'https://ttraff.club/wix?keyword=asphalt+xtreme+cheat+codes', suggesting a lure to a site offering cheat codes. This indicates a phishing or scam attempt to redirect users to malicious infrastructure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=asphalt+xtreme+cheat+codes
- https://43294bac-90a2-477a-9cba-783f8009860f.filesusr.com/ugd/1d3654_bfc7aef7a71e4664973fbe2064d6f241.pdf?index=true
- https://d6e74e09-637c-4e71-b6a6-daea4b837916.filesusr.com/ugd/9ef0c3_69fb24eb38324046a3116b86180b42ea.pdf?index=true
- https://f1ea2689-bba1-497f-aaa6-cec79b7e2495.filesusr.com/ugd/affaa6_ec9e6bc03bde4cd6adba59ba59591a37.pdf?index=true
- https://fe082dce-66c9-4567-ba73-9086ccfc3e29.filesusr.com/ugd/3bca44_e2b59503b0a64e6997e58494534fcbe4.pdf?index=true
- https://cdn.shopify.com/s/files/1/0431/6374/6465/files/nidefedifodimirugowo.pdf
- https://cdn.shopify.com/s/files/1/0431/3494/3388/files/metabolic_syndrome_and_related_disorders.pdf
- https://993dabc2-886d-43d0-8c92-fdf8d1a203f3.filesusr.com/ugd/81d6a4_632c332ec1aa4b95b64be405021ed0f4.pdf?index=true
- https://99733086-16d0-4551-ae4e-662bffded64b.filesusr.com/ugd/b1b16e_a27a43ea626940ecb35789c2e6f520cf.pdf?index=true
- https://f2000082-9d0d-4d58-9b92-64c04d768dc6.filesusr.com/ugd/bba345_748907ce45c44423a491cf49fffa6150.pdf?index=true
- https://a6c1b372-a7e7-48af-bdf8-c6830b879c2a.filesusr.com/ugd/48bf55_510a56eb3def4eb18057b1b686566a8b.pdf?index=true
- https://76ce76ed-234a-4d86-aa79-d459a80e5324.filesusr.com/ugd/1e11d0_8b7857e362b24be9a1945705d901fa06.pdf?index=true
- https://cc855a7f-1b7f-412f-bef0-6883a0f77e5a.filesusr.com/ugd/a42eed_eddfccb708bc456c8205968c88dc896e.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005744.bin` `69adf9492b8abd35fef915d9c722faea48b1287f03c54a84a56c25a44a81a4f9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5744	5004 bytes
`font_01_sfnt_off0000683f.bin` `13ef301d7397db66c2bb0c6301bbc7e54c6689926e8ebd12b7554a9727807b88`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x683F	10688 bytes
`font_02_sfnt_off00008c9d.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C9D	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.