PDF malware analysis — malicious · db30592e14a4023f

MALICIOUS

PDF

43.3 KB Created: 2020-08-31 02:33:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6b8c20bbb7730b6e762f1a30d6100dfd SHA-1: 7b4427dfa97aef55e7aa4fc925660856d4002b0d SHA-256: db30592e14a4023fce3887b6a6ab2fbdc5b5aa0514faab03a3edb2b1803d9a1f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, a technique often used for SEO spam or to redirect users to malicious websites. One prominent link, 'https://ttraff.com/wix?keyword=eminem+the+way+i+am+book+pdf', is flagged as a malicious redirector. The document body, though partially corrupted, suggests a lure related to 'Eminem the way i am book pdf', indicating an attempt to exploit user interest for malicious purposes. The presence of a link farm heuristic further supports the malicious intent.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=eminem+the+way+i+am+book+pdf
- https://static.usrfiles.com/ugd/b8c837_b4a197002e1a48ee833a6cc440b77a39.pdf
- https://static.usrfiles.com/ugd/76b6de_327960b741af4e028154fad22e77a31c.pdf
- https://static.usrfiles.com/ugd/b8c837_5e363015ff504085a3de576f5df0ec33.pdf
- https://static.usrfiles.com/ugd/b8c837_7499261b048c48148410d7ed21b63506.pdf
- https://static.usrfiles.com/ugd/26938b_d760f0a89c5f449b903bd9d3c3d6ad8e.pdf
- https://static.usrfiles.com/ugd/79cb75_be979cb0fbdb4b439e3b20d82baec2f7.pdf
- https://static.usrfiles.com/ugd/a2d007_73ed49482dc2481dabe274c29c754117.pdf
- https://static.usrfiles.com/ugd/b8c837_da0e981594ba4776892747714e25d664.pdf
- https://static.usrfiles.com/ugd/9f6a24_75bc22b4ae5144fa946fb9a5ecefb73d.pdf
- https://static.usrfiles.com/ugd/e73fea_be4911deaffd42f9aa76926c79bb696d.pdf
- https://static.usrfiles.com/ugd/9e14ca_5b9ffba80a684a6485c2011d3b6c8c99.pdf
- https://cdn.shopify.com/s/files/1/0438/9853/6091/files/zoe_happy_fit_guide.pdf
- https://cdn.shopify.com/s/files/1/0434/0973/5845/files/sewavalotijo.pdf
- https://cdn.shopify.com/s/files/1/0430/7386/3842/files/acoustic_analysis_of_speech.pdf
- https://cdn.shopify.com/s/files/1/0435/7468/9955/files/aesop_rock_labor_days.pdf
- https://cdn.shopify.com/s/files/1/0430/5233/5255/files/future_tenses_exercises_with_ans.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006b36.bin` `2098fecf8d840c8fc7ef2d354b2bcd39650d7d1ee159fa1dae1b88f41c94d04e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B36	5332 bytes
`font_01_sfnt_off00007d42.bin` `5305d6d268d8185cf92445cd78f982fc75e01c674b9e3bab870d84f70fbfaf73`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D42	10392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.