PDF malware analysis — malicious · d6c737723f2cd574

MALICIOUS

PDF

49.8 KB Created: 2020-08-29 17:19:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f5e63b4731c0afacff90c0144f047419 SHA-1: 3cecdf5220b6fca0e6a8f7d4d039de7392276a8e SHA-256: d6c737723f2cd5740c2a245738471595b459701799ba1178f7b6b553541663e0

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link to a redirector URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. This link, 'https://ttraff.ru/wix?keyword=acer+aspire+5742+drivers', is presented in a context that suggests a driver download, as indicated by the document body and the SE_DOWNLOAD_BUTTON heuristic. The PDF also exhibits characteristics of a link farm, with numerous external PDF links, as flagged by PDF_SEO_LINK_FARM. The primary malicious IOC is the redirector URL, which likely leads to further malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=acer+aspire+5742+drivers
- https://static.usrfiles.com/ugd/b8c837_e61ca8ca5bbe4d16a1c09b3faeaadb92.pdf
- https://static.usrfiles.com/ugd/b8c837_607e5fb06bcc44f8b07ec7d86fae0efb.pdf
- https://static.usrfiles.com/ugd/b8c837_e849912209f04ee8b3916722d17836b9.pdf
- https://static.usrfiles.com/ugd/b8c837_e1f893424f6f45a6bf6d60411436a869.pdf
- https://static.usrfiles.com/ugd/b8c837_a3b7f89ebf664e7781ebe8447bac87b9.pdf
- https://static.usrfiles.com/ugd/b8c837_955cc8c129214fe992c80447ae5ef0ac.pdf
- https://static.usrfiles.com/ugd/b8c837_bedd8e080bf247bbb2d10ff3f6795f97.pdf
- https://static.usrfiles.com/ugd/bf650e_84452f8a8fea4f648e1a9f3993cd5363.pdf
- https://static.usrfiles.com/ugd/b8c837_4ce93d7e56684d80976aec5ef8e902b1.pdf
- https://static.usrfiles.com/ugd/eb4c03_3b626737aff24e4696fe978604c8ba33.pdf
- https://static.usrfiles.com/ugd/b8c837_c468c2040188450289c3949a2aa6740d.pdf
- https://static.usrfiles.com/ugd/b8c837_7104a7ca51f5421692aa516abb9af24d.pdf
- https://static.usrfiles.com/ugd/b8c837_71f563edebbe41209750c9d1d639ab3c.pdf
- https://static.usrfiles.com/ugd/b8c837_362636c542d14cf99d234a49f50086fc.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000077ee.bin` `1b6a8b22576f49fa45ba374601781aae7345cea1f6be29a876a902a1eb417a72`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77EE	5508 bytes
`font_01_sfnt_off00008ac9.bin` `060cd608f54a6784af4a0becaf5a9be8bf68f3734c428c33b1077e09c82076f0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8AC9	15436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.