PDF malware analysis — malicious · da09042928e93f99

MALICIOUS

PDF

44.4 KB Created: 2020-09-01 04:04:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3cff7fd13a4b3047f54480d18d584178 SHA-1: cbfc1d4987d3502fb0dfea00da0c57c768ed16d1 SHA-256: da09042928e93f9905b40ad2ed28e2cc1e3e8454e6e63c7d5e77163073c9e838

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.ru/wix?keyword=testosterone+metabolism+pdf'. Additionally, it exhibits characteristics of a PDF link farm, embedding numerous external links, with 'https://static.usrfiles.com/ugd/f46427_aca54aa76eef49f7a34aa4fd4c89ec18.pdf' being the first listed. The document body, though heavily obfuscated, contains the same URL, suggesting a deliberate attempt to disguise the malicious destination.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=testosterone+metabolism+pdf
- https://static.usrfiles.com/ugd/f46427_aca54aa76eef49f7a34aa4fd4c89ec18.pdf
- https://static.usrfiles.com/ugd/79e0dc_4bfc5f116fee469985d8efccf2c44f38.pdf
- https://static.usrfiles.com/ugd/b7ab08_641dc04b39414af6a03dabe5c7242ebc.pdf
- https://cdn.shopify.com/s/files/1/0432/3491/8558/files/49386512570.pdf
- https://cdn.shopify.com/s/files/1/0438/5210/3842/files/saxon_algebra_2_solutions_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/4306/0901/files/dimplex_fireplace_manual.pdf
- https://cdn.shopify.com/s/files/1/0437/4416/6037/files/kidubo.pdf
- https://cdn.shopify.com/s/files/1/0454/6068/4952/files/doneguji.pdf
- https://static.usrfiles.com/ugd/3bcfef_76ea2765557e4699988ce0c86adb2c16.pdf
- https://static.usrfiles.com/ugd/dad90e_7ba2f41488ee4350b8f87d0255a1b9b1.pdf
- https://static.usrfiles.com/ugd/de60da_4abb16c363884545b0f888a73ca5f6d4.pdf
- https://static.usrfiles.com/ugd/b8c837_f721d03694f1425494fa6545c4b64ef2.pdf
- https://static.usrfiles.com/ugd/b8c837_8f75cbe2ef9d4d4c8938b6be3df69f31.pdf
- https://static.usrfiles.com/ugd/b8c837_c63e815e773a4c7ea93a1fa3253f668e.pdf
- https://static.usrfiles.com/ugd/e3325f_dc9bf85b1b3c47d88a057413b80a1931.pdf
- https://static.usrfiles.com/ugd/2f7815_e604658364034377bf3027942a8961c1.pdf
- https://static.usrfiles.com/ugd/b8c837_eb335737a47b4a68aba77d7ba136fa2a.pdf
- https://static.usrfiles.com/ugd/e2c6c1_4a3077f8cc7149198db33b5950cee84a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007057.bin` `8f306f2706eee40c41a3560b27ac8a3178a08c1bd11b7247c11a4f47179b7fe7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7057	5276 bytes
`font_01_sfnt_off00008224.bin` `8c530837c0960c0a70ca0d36b433bb2b68feef12b1518f11d879a1ec42432d65`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8224	9960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.