PDF malware analysis — malicious · ce3354b4d518c6c3

MALICIOUS

PDF

63.9 KB Created: 2020-08-31 20:23:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5382aaf17f2db1b5e8ba6393e7787aa0 SHA-1: 5415d7fe639f6ba4072199f772caafd7e03c7eff SHA-256: ce3354b4d518c6c32dd6f1378ed981313d2fb21d9439cb737099a78e08137ab2

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with a critical heuristic firing indicating a link to known malicious redirector infrastructure. The embedded URL 'https://ttraff.me/pify?keyword=dolphin+web+browser+apk+free' is likely intended to lead the user to download unwanted software. The document body, though heavily obfuscated, contains references to the redirector URL and other benign-looking PDF links, suggesting a deceptive lure.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=dolphin+web+browser+apk+free
- https://static.usrfiles.com/ugd/8dde66_78a376ac4bf543f59beffc833745eb47.pdf
- https://static.usrfiles.com/ugd/b8c837_0101ef8a9c1742d981a7ea29c01fd187.pdf
- https://static.usrfiles.com/ugd/b8c837_d57a875f48484ecb9c7ba2770793a251.pdf
- https://static.usrfiles.com/ugd/b8c837_cdab2dccb402495a86ba068b6380eaa2.pdf
- https://static.usrfiles.com/ugd/e2f7e1_e1d7d952c9bc46e6a41b6e60d0eacdd5.pdf
- https://cdn.shopify.com/s/files/1/0433/5108/1114/files/casos_para_assessment_center.pdf
- https://cdn.shopify.com/s/files/1/0454/2916/2152/files/airservices_australia_annual_report.pdf
- https://cdn.shopify.com/s/files/1/0430/1481/5901/files/zewuvepetawobajezikeva.pdf
- https://cdn.shopify.com/s/files/1/0431/7921/2959/files/geometry_seeing_doing_understanding.pdf
- https://cdn.shopify.com/s/files/1/0431/9143/5422/files/34147291111.pdf
- https://static.usrfiles.com/ugd/cc03df_13b25a6f2311430ea05af4c3ba6d123b.pdf
- https://static.usrfiles.com/ugd/b8c837_8a7bf8554a97403e93b7d87f1af93064.pdf
- https://static.usrfiles.com/ugd/b11f6d_00aa99a897144cc18ecd8cb63cdc2c9d.pdf
- https://static.usrfiles.com/ugd/921909_41eb660d6f2943389e9101930a325a68.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000067e6.bin` `e26e33ba4d5a72011d56220173cf0d91c5f10401f8c20e889e782721dcb067f0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x67E6	5284 bytes
`font_01_sfnt_off000079e2.bin` `5d4046d508176b90485e495d278410ecbd4d24d4054072753fc15d775dd9d4b9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79E2	20244 bytes
`font_02_sfnt_off0000b7a4.bin` `e1a42f3573c55e003ebfc0dc81323aa5fefc3e0db2f45310ee7f7b7088663df6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB7A4	10444 bytes
`font_03_sfnt_off0000db94.bin` `5cd60b6eacfaa6794cb303b8e6b430ba88de053d794df63fbf72832dc074cc84`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB94	16512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.