PDF malware analysis — malicious · ccc983d83b35d95e

MALICIOUS

PDF

47.6 KB Created: 2020-08-30 08:18:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8c07270c689b05fb1a49324bd4b2aff7 SHA-1: da7e6992bb928d29a68ca071dd535c512a4101f7 SHA-256: ccc983d83b35d95e666481126514bf06ae695988421a35da5308d6921783ff78

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains a significant number of embedded links, identified as a PDF link farm. One of these links, https://ttraff.com/wix?keyword=math+word+problems+4th+grade+addition+subtraction, is flagged as a known malicious redirector. The document body, though heavily obfuscated, appears to contain text related to math word problems, likely serving as a lure. The presence of a link farm and a malicious redirector strongly suggests an attempt to lure users to malicious sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=math+word+problems+4th+grade+addition+subtraction
- https://cdn.shopify.com/s/files/1/0428/0595/2671/files/20249879831.pdf
- https://cdn.shopify.com/s/files/1/0431/5663/5816/files/greek_and_latin_prefixes.pdf
- https://cdn.shopify.com/s/files/1/0430/0665/6666/files/97857911252.pdf
- https://static.usrfiles.com/ugd/b8c837_0dc2bb375e19499ba24623f6837afb66.pdf
- https://static.usrfiles.com/ugd/b8c837_04575e3c877248a19f699182ba6cc4b2.pdf
- https://static.usrfiles.com/ugd/99965f_297a2fcc63ac4805a3564e4e03949b5c.pdf
- https://static.usrfiles.com/ugd/5fd5c1_795155e6a58a4b69b42404448f305c11.pdf
- https://cdn.shopify.com/s/files/1/0435/3143/6186/files/attendance_record_template_excel.pdf
- https://cdn.shopify.com/s/files/1/0430/9496/6429/files/femekanazafudowera.pdf
- https://cdn.shopify.com/s/files/1/0427/6404/2396/files/ronofuraletu.pdf
- https://cdn.shopify.com/s/files/1/0437/3338/5381/files/70798627603.pdf
- https://cdn.shopify.com/s/files/1/0430/9372/1255/files/glencoe_economics_today_and_tomorrow.pdf
- https://static.usrfiles.com/ugd/b91566_d09aa5d684f445c6a23d0c1d1e732751.pdf
- https://static.usrfiles.com/ugd/b8c837_dc3bc6cf448b46d28de180040076090d.pdf
- https://static.usrfiles.com/ugd/a771bd_dfb0f34990974a53bdde900e67890b06.pdf
- https://static.usrfiles.com/ugd/74a852_5d3d886e25dd4cfeaca3e102b4c076b3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0430/0665/66

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007b31.bin` `991a2f43bc4e6d51821b60e2d28aa66b113c76820c124d2090cf4d46c426864a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B31	5812 bytes
`font_01_sfnt_off00008ef4.bin` `ce9c660f3567b14845c248913caeab5056f49135f2bde52f6830f9ed5de74501`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8EF4	9892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.