PDF malware analysis — malicious · def7042f4772e49d

MALICIOUS

PDF

46.8 KB Created: 2020-08-31 04:08:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6de91f820c6df3bb831750213867f00c SHA-1: d417f358336330f6f3cceaf4d2c1cc5a8b7ee0d3 SHA-256: def7042f4772e49de72cad042935e4554f49fb6b8ff2d4a3820fb34fc320ae86

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.me'. Additionally, it exhibits a PDF link farm with numerous external links, many hosted on 'static.usrfiles.com'. The document body, though heavily obfuscated, contains the redirector URL and appears to be generated by wkhtmltopdf, suggesting a programmatic approach to creating a lure. The primary intent appears to be directing users to malicious sites via these links.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=kern+county+code+enforcement
- https://static.usrfiles.com/ugd/eda9ba_c5ff00accf56431fb8df40801ff36c86.pdf
- https://static.usrfiles.com/ugd/b8c837_6366e65a4a3b459eb9fa0198f48752ea.pdf
- https://static.usrfiles.com/ugd/b972d5_37e6eaeb6cc84fc7a4c371d5fb9c42cc.pdf
- https://static.usrfiles.com/ugd/b8c837_9a55c4dce9a14d7fb8f43818fd586b1a.pdf
- https://static.usrfiles.com/ugd/b8c837_c080850913a1470aabe575ec17ed4d95.pdf
- https://static.usrfiles.com/ugd/f3ecbe_6581f99b1eec40bc8ed5792899eebfaf.pdf
- https://static.usrfiles.com/ugd/a6e5e9_aefa9e67de2c4c4cab498dac6f8c4b52.pdf
- https://static.usrfiles.com/ugd/b8c837_ce3f2f25aa1e4084bad786a8a5ad2a0c.pdf
- https://static.usrfiles.com/ugd/003b86_2bd1af37237a4f13a3c2b13537c49095.pdf
- https://cdn.shopify.com/s/files/1/0430/4050/6009/files/xatejazusi.pdf
- https://cdn.shopify.com/s/files/1/0428/6735/9900/files/vuwerosokobutu.pdf
- https://cdn.shopify.com/s/files/1/0432/7548/5348/files/gatonoruzabiledodinovuga.pdf
- https://cdn.shopify.com/s/files/1/0428/3321/5654/files/nipikefadarofusexiko.pdf
- https://cdn.shopify.com/s/files/1/0434/6000/1954/files/58558570209.pdf
- https://cdn.shopify.com/s/files/1/0436/2344/8736/files/40184611628.pdf
- https://cdn.shopify.com/s/files/1/0434/7428/8793/files/rajesh_rajamani_vehicle_dynamics_and_control.pdf
- https://cdn.shopify.com/s/files/1/0461/9616/2711/files/6905404296.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000078b7.bin` `f8ae15bf2f24097a5f91cf44860459931968e0d0c5f5ba1235603e1114abf1db`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78B7	4820 bytes
`font_01_sfnt_off0000890b.bin` `d22aedfb972375a0cbec1d072a41d1b2f5c6dea7d1b0c99babff06a9ac2fd2de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x890B	11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.