PDF malware analysis — malicious · d2e92225d2cf3be6

MALICIOUS

PDF

50.9 KB Created: 2020-08-30 08:27:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4a5e1151a27d519aebeb8453e87f2e85 SHA-1: 7d67897a6f415d0b6631a36983f8f2a2e7a50774 SHA-256: d2e92225d2cf3be69f4d5323cb0a5df3ff20cbc839c57e3a8e859ffa3a24eaf1

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, many of which point to a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'Gabarito enem 2016', suggesting a lure to trick users into clicking the malicious links. The primary malicious URL is https://ttraff.com/wix?keyword=gabarito+enem+2016+2+dia+azul, which is likely used to redirect users to further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=gabarito+enem+2016+2+dia+azul
- https://static.usrfiles.com/ugd/b8c837_fbbe5d7c3b594555a9671ce984d57710.pdf
- https://static.usrfiles.com/ugd/f84671_5c49e1fd46bc473e8cba9bb43d307d56.pdf
- https://static.usrfiles.com/ugd/4f270c_48482ee50a8b4556bff191274938ebf7.pdf
- https://static.usrfiles.com/ugd/b8c837_01dff94f677c43b0b26f763c251e3641.pdf
- https://static.usrfiles.com/ugd/87a178_05d74231781f464792fd547047954abe.pdf
- https://static.usrfiles.com/ugd/b8c837_9c96f03232f04614b75e5c3fb64f32f6.pdf
- https://static.usrfiles.com/ugd/b8c837_06205787d8f742418bc3961336617df3.pdf
- https://static.usrfiles.com/ugd/b8c837_838b1f6d921a45f588b90eeb6c1afaef.pdf
- https://static.usrfiles.com/ugd/739437_3813043942d0443c9d3c5af5ba28f683.pdf
- https://cdn.shopify.com/s/files/1/0433/7437/9173/files/pamugimunixexurezuzulagid.pdf
- https://cdn.shopify.com/s/files/1/0428/1021/2519/files/guferanozokenavak.pdf
- https://cdn.shopify.com/s/files/1/0434/1081/7180/files/hcm_ka_full_form.pdf
- https://cdn.shopify.com/s/files/1/0430/3909/6986/files/comparative_and_superlative_exercises.pdf
- https://cdn.shopify.com/s/files/1/0429/5193/4108/files/libro_reproduccion_animal.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006392.bin` `4b0fc8c38e151496c8f65c6516f319ffa7bb6c6ea2668f7ea163f00d058e4ce7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6392	5492 bytes
`font_01_sfnt_off00007630.bin` `76670eb83eb05102dac1d41c9faef06a8556b61a04ef38c1ee6271add0f05d09`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7630	2176 bytes
`font_02_sfnt_off00007ff8.bin` `b59f29ea7b2359bf3ee145179e078f64b7e6a75d95d6fd4cafdb7761d3e646f2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7FF8	12616 bytes
`font_03_sfnt_off0000a67c.bin` `6ab11544500cf49154a6beafe7a8c75b771cfd598e147caafdad62332111c2ab`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA67C	16628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.