PDF malware analysis — malicious · d89f958ede331f78

MALICIOUS

PDF

47.2 KB Created: 2020-08-30 05:37:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 004291dc4417dda9033a63ac9dc8f7f1 SHA-1: 2412467c06f519c27b77d03f590e767bd76d8194 SHA-256: d89f958ede331f781b3ad7483ba409aafed51135c3559731fc7d55edbf8f97a2

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204 Malicious Link T1204.001 Malicious Link: Malicious Link

The PDF contains a mass external link farm, with the primary malicious redirector URL being https://ttraff.club/wix?keyword=google+translate+chrome+extension+offline. The document body and heuristics indicate a social-engineering lure, prompting the user to install a browser extension or update to view content. This is a common tactic for credential theft or malware delivery.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=google+translate+chrome+extension+offline
- https://cdn.shopify.com/s/files/1/0431/3032/3095/files/futabobasiwuben.pdf
- https://cdn.shopify.com/s/files/1/0440/6162/2437/files/student_council_speeches_examples.pdf
- https://cdn.shopify.com/s/files/1/0462/4318/4794/files/5334050229.pdf
- https://cdn.shopify.com/s/files/1/0433/6045/2760/files/86840530089.pdf
- https://static.usrfiles.com/ugd/3bca44_5deef28ca2854a3d949468feafe8842a.pdf
- https://static.usrfiles.com/ugd/e5a943_50241a041bf546ada1ab1e9de372c29c.pdf
- https://static.usrfiles.com/ugd/5b9a87_ce348269f860459e84880686a243bfae.pdf
- https://static.usrfiles.com/ugd/b8c837_d6aa5856e65c4a2897197dd5478ca743.pdf
- https://static.usrfiles.com/ugd/b8c837_ada084d37453491c81c6fd609163feab.pdf
- https://static.usrfiles.com/ugd/ae059d_1172982d880c4796a62c35e1314d4567.pdf
- https://static.usrfiles.com/ugd/b8c837_595645a606b9452192fa9041e802d36b.pdf
- https://static.usrfiles.com/ugd/b48b60_6eaf14bc46324714b1c4adb4b1897ecf.pdf
- https://static.usrfiles.com/ugd/3f80ec_dffa6871d1dd48f9839a06eb271f0d8d.pdf
- https://static.usrfiles.com/ugd/b8c837_fe21bb3b5f854e4bb769562a51c4d40a.pdf
- https://static.usrfiles.com/ugd/b8c837_4d77737b94d848dcb854940b484f6258.pdf
- https://static.usrfiles.com/ugd/6cf392_3f449df137e7435598320426567b9312.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007909.bin` `1aa70563f4fca1c8e8c72a2548091953121fdea333d7ade078de8538c3369304`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7909	5396 bytes
`font_01_sfnt_off00008b3d.bin` `f40ed6c197b652fcd6dd6f666b93dc3f6eb92752c27cab865fb6e3ce8fe24173`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B3D	10780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.