PDF malware analysis — malicious · d4911ed196f67694

MALICIOUS

PDF

37.3 KB Created: 2020-08-02 05:13:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6f62bfa10db478f63a1b4d8635119c79 SHA-1: 2c4b1e9efa56acaeb7d596ab18a08517eb255a47 SHA-256: d4911ed196f676944fbda24867e6590292d378c341d419fd1b0737d173efcae3

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains the same URL, suggesting it's the primary lure. The PDF also exhibits characteristics of a link farm, embedding numerous external links, many hosted on Shopify, which is a common tactic for SEO poisoning or distributing malicious content. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=griffiths+quantum+mechanics+solutions+pdf+free+download
- http://files.ofpastoralcharge.com/uploads/1/3/1/3/131384171/3ddbcb4e5.pdf
- http://files.whateverhetellsyou.com/uploads/1/3/1/3/131384359/7c9bdfd7df86.pdf
- http://files.carolinagartnerart.com/uploads/1/3/1/4/131454850/f2cf99835e8923e.pdf
- http://files.shotwellsharkband.com/uploads/1/3/2/6/132681033/diramad_vegikakafuzamu.pdf
- https://cdn.shopify.com/s/files/1/0436/4707/4464/files/columbia_md_21045_weather.pdf
- https://cdn.shopify.com/s/files/1/0429/0537/0791/files/jalerirabanepinuxuj.pdf
- https://cdn.shopify.com/s/files/1/0429/5720/9753/files/51934746375.pdf
- https://cdn.shopify.com/s/files/1/0432/4294/6724/files/12002541250.pdf
- https://cdn.shopify.com/s/files/1/0436/9167/1705/files/xonobos.pdf
- https://cdn.shopify.com/s/files/1/0433/2670/1718/files/29827038966.pdf
- https://cdn.shopify.com/s/files/1/0429/4891/9450/files/xewutivutesitegabasik.pdf
- https://cdn.shopify.com/s/files/1/0427/8996/1884/files/wixujaboxexopilupe.pdf
- https://cdn.shopify.com/s/files/1/0436/8020/2905/files/32193303709.pdf
- https://cdn.shopify.com/s/files/1/0433/1359/4526/files/lumona.pdf
- https://cdn.shopify.com/s/files/1/0441/0081/2952/files/munenolabepara.pdf
- https://cdn.shopify.com/s/files/1/0435/0155/1771/files/nulitilugoguforomib.pdf
- https://cdn.shopify.com/s/files/1/0434/3916/1500/files/zaketigebugoru.pdf
- https://cdn.shopify.com/s/files/1/0431/2177/0656/files/74165166027.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0431/2177/0656/files/74165166027.pd

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000053ad.bin` `37c029b6964ea29ef2d5ef4137a7a1c7422f63c1b933782eb00c425ac06a329c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x53AD	5644 bytes
`font_01_sfnt_off000066c7.bin` `a7a33514501c096980f7c8d1458b624a643762eb56829a18fa24a3f038b85396`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66C7	9668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.