PDF malware analysis — malicious · dbf601656c293034

MALICIOUS

PDF

42.5 KB Created: 2020-08-29 03:40:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 663aa7d8a4fea7473ecb2bb50f0c8d0b SHA-1: cb23bfe498b675ea73e602e9f8fb55a3f0e211d7 SHA-256: dbf601656c2930342f34e9c87849e76eb93ce3da3366da2d9316975db97b9fcf

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/wix?keyword=mcgraw+hill+4th+grade+math+home+link'. The document body, though heavily obfuscated, contains references to educational material ('mcgraw hill 4th grade math home link') and the authoring application 'wkhtmltopdf', suggesting a lure. The presence of numerous embedded links, many pointing to 'static.usrfiles.com', further supports the link farm heuristic. The primary malicious IOC is the redirector URL.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=mcgraw+hill+4th+grade+math+home+link
- https://static.usrfiles.com/ugd/b8c837_3c927daec25a43e19492cef53399f345.pdf
- https://static.usrfiles.com/ugd/b8c837_fcf4b8c98aaa4caeb5af05cb87614eb8.pdf
- https://static.usrfiles.com/ugd/b8c837_6b386d4fea1f4f8880ee482204dfd440.pdf
- https://static.usrfiles.com/ugd/b8c837_54006e7f050844a7b4ee4e91129b97e3.pdf
- https://static.usrfiles.com/ugd/b8c837_e4aa6b03043540a28a1ca0aa45a52158.pdf
- https://cdn.shopify.com/s/files/1/0437/9105/7058/files/antioxidant_activity_thesis.pdf
- https://cdn.shopify.com/s/files/1/0434/4889/3606/files/movaxebevenapanupi.pdf
- https://cdn.shopify.com/s/files/1/0429/5586/6263/files/dosozibeviboko.pdf
- https://cdn.shopify.com/s/files/1/0429/7061/1871/files/99226187875.pdf
- https://static.usrfiles.com/ugd/b8c837_21f9a8864bee4d519ff29d43c182de6d.pdf
- https://static.usrfiles.com/ugd/b8c837_c40b7f75d40843f795fd81b4eabcf8ef.pdf
- https://static.usrfiles.com/ugd/b8c837_ceab100c7ad044f2b9bdfc36ff82f750.pdf
- https://static.usrfiles.com/ugd/b8c837_81171a28561940d09ed1a8e461cc24b1.pdf
- https://static.usrfiles.com/ugd/b8c837_4b8b50b6c65d44b3a894d9dbbbea10e3.pdf
- https://static.usrfiles.com/ugd/b8c837_abcf35407fab42aab17ac4e20d9a7c69.pdf
- https://static.usrfiles.com/ugd/b8c837_7ecd29a50d8c4831847747d0c6715636.pdf
- https://static.usrfiles.com/ugd/b8c837_99c0c71b95044af3ad1db1c9017334a3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065e5.bin` `61e87713bc8cbbfe7ed1f319c9ca663c4402a393ed329008225a9398a60e83f1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65E5	5424 bytes
`font_01_sfnt_off00007849.bin` `0816bba0348553a09fd66c13f1f59832ea1a03034e5cce96e3a47c7b234b0b38`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7849	10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.