PDF malware analysis — malicious · dc42a9374422ea87

MALICIOUS

PDF

46.3 KB Created: 2020-08-30 08:45:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e10c2e9d9672194703eacfcff21e84e5 SHA-1: 2004cad84131d447fb02d780f863d073f74b266d SHA-256: dc42a9374422ea870d421134bb46e5ff2b71314a40c7179d569796ac87084a24

130 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains multiple embedded links, with one identified as a malicious redirector at 'https://ttraff.com/wix?keyword=pride+and+prejudice+study+guide+questions'. The document body, though heavily obfuscated, appears to be a lure related to 'Pride and Prejudice study guide questions', aiming to trick users into clicking the malicious link. The presence of numerous other PDF links suggests a link farm or SEO poisoning tactic to distribute malicious content.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=pride+and+prejudice+study+guide+questions
- https://cdn.shopify.com/s/files/1/0435/8170/2301/files/76856033697.pdf
- https://cdn.shopify.com/s/files/1/0436/9534/1723/files/66419744383.pdf
- https://cdn.shopify.com/s/files/1/0439/1396/9819/files/windsor_ct_see_click_fix.pdf
- https://cdn.shopify.com/s/files/1/0436/2806/9017/files/bikini_body_guide_workout_free.pdf
- https://cdn.shopify.com/s/files/1/0447/3444/7770/files/opencv_for_python_3._6.pdf
- https://cdn.shopify.com/s/files/1/0441/2122/7416/files/wugut.pdf
- https://static.usrfiles.com/ugd/b8c837_68e07adc3cec48a5ac8e7386976720b0.pdf
- https://static.usrfiles.com/ugd/b8c837_434ccc9b8f9e4b3ba382b2214af7b011.pdf
- https://static.usrfiles.com/ugd/ab0441_07d643513b72453aa604ac9e6e614cc7.pdf
- https://static.usrfiles.com/ugd/b8c837_ad839648952a4f50aded2fd2e65d4f8a.pdf
- https://static.usrfiles.com/ugd/2e79a6_b64d5118b1a84af2b080af895df99b1f.pdf
- https://cdn.shopify.com/s/files/1/0434/6091/9461/files/salagiredilixona.pdf
- https://cdn.shopify.com/s/files/1/0436/4192/9886/files/xoborazutob.pdf
- https://cdn.shopify.com/s/files/1/0434/9935/6324/files/kezalujuvibapulomawijob.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000772b.bin` `9ebc1e9ab27cbbffdeb527df06081e8e48900a953ab86b3afaf7fd016e07b9f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x772B	5516 bytes
`font_01_sfnt_off000089ed.bin` `27be9819bc60759c452c70ba29b8e685dd38bebca56b571058ef70a7f1cbc6b0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x89ED	9876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.