PDF malware analysis — malicious · d849f3be6589f592

MALICIOUS

PDF

56.6 KB Created: 2020-08-30 09:26:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 740fa0d536e94c26ff137a597cf3d88e SHA-1: 97d02e45c4f693a1b24923fb1ae1c8c4fd1863ee SHA-256: d849f3be6589f59267ad61504ab945875770acd71a7f7f38bedbf52e961fe002

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with one heuristic specifically flagging it as a 'PDF_SEO_LINK_FARM'. The primary malicious link identified is 'https://ttraff.com/wix?keyword=omake+donald+had+a+farm', which is categorized as a malicious redirector. The document body itself is heavily obfuscated and contains metadata indicating it was generated by wkhtmltopdf, suggesting it's not a typical user-facing document but rather a container for malicious links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=omake+donald+had+a+farm
- https://static.usrfiles.com/ugd/b8c837_89deb405e9c14ee8831dc4f28eac3b67.pdf
- https://static.usrfiles.com/ugd/314c35_87fdcc2bb58f4cb882375c9777b92158.pdf
- https://static.usrfiles.com/ugd/b8c837_aa2cf6b96ada42b1abdcefda0868898e.pdf
- https://static.usrfiles.com/ugd/b8c837_94a74801f76b4755a92aa15516616763.pdf
- https://static.usrfiles.com/ugd/3aee12_97597051982d4f34a7118cbb563ab322.pdf
- https://cdn.shopify.com/s/files/1/0433/1238/2116/files/wanumu.pdf
- https://cdn.shopify.com/s/files/1/0451/2271/5801/files/dasejamovapirovaxonimune.pdf
- https://cdn.shopify.com/s/files/1/0436/1509/2894/files/wniosek_ceidg_1_wypeniony.pdf
- https://static.usrfiles.com/ugd/ab0441_0cba1d8dbcb845f387e277c4d5b6338a.pdf
- https://static.usrfiles.com/ugd/b8c837_79498a9681a742d5ad474c77ba802910.pdf
- https://static.usrfiles.com/ugd/b8c837_20cc7e4667424dc59be3dfd229417251.pdf
- https://static.usrfiles.com/ugd/ca9b0a_509d3bfdbfe54c7f82b06fe516d91809.pdf
- https://static.usrfiles.com/ugd/b8c837_410ac11a24bc4a97b1c6fbf94b111d5f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000638d.bin` `bc1831dccffd2e61cfef12c0fcd72356066f500538a7de6adaf7d7bb7529cc91`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x638D	9348 bytes
`font_01_sfnt_off00008324.bin` `69b957f0a6446383537232da3304ffa4b1486b4661e6e2e7efb845cf39e4fbd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8324	5060 bytes
`font_02_sfnt_off0000942c.bin` `3700b11b69baf41765b365b9d1b0d896215400777e19ecc50780af106bebcfe7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x942C	11192 bytes
`font_03_sfnt_off0000ba03.bin` `eb24dadaab93c323ff04559e6d2ddb302529df5469d39f33624665c157924266`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBA03	17736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.