PDF malware analysis — malicious · dfcf10ccd5cf7455

MALICIOUS

PDF

42.5 KB Created: 2020-09-01 12:49:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4998f64c3eb9d2091e4e39b5f766aa7e SHA-1: c9892a69ee38e059d81a2766999569585d9f1904 SHA-256: dfcf10ccd5cf74554bf93d0f50e6e8126a9d4cb01385aefe515b122734b8562c

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded URLs, with a critical heuristic firing for PDF_SEO_LINK_FARM indicating a link farm. Another critical heuristic, PDF_MALICIOUS_REDIRECTOR_LINK, points to a known malicious redirector. The presence of a visual download button lure further supports a malicious intent. The primary IOC is the redirector URL, which is likely the entry point for further malicious activity.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=book+list+guided+reading+level+i
- https://cdn.shopify.com/s/files/1/0433/6241/8846/files/pitubaxapujosilufewu.pdf
- https://cdn.shopify.com/s/files/1/0431/0564/8801/files/gipexujuwulet.pdf
- https://cdn.shopify.com/s/files/1/0433/5144/1560/files/zumetikejelafanovu.pdf
- https://cdn.shopify.com/s/files/1/0429/2041/1303/files/ashburton_weather_report.pdf
- https://static.usrfiles.com/ugd/de65f7_1ce1df8c2bea45e8b997370321c6b3d2.pdf
- https://static.usrfiles.com/ugd/b8c837_699892ac357241d5b7e9cd3e6467d43f.pdf
- https://static.usrfiles.com/ugd/b8c837_60b4d206c38c471dbc1e33b39cfaf50f.pdf
- https://static.usrfiles.com/ugd/b8c837_21299698ec9846c19e961adc3ac3e058.pdf
- https://static.usrfiles.com/ugd/b8c837_b990027b51764463bd2c0b63f04a42d4.pdf
- https://static.usrfiles.com/ugd/b65acf_6082194a496348f9b938e11a33ba5bf1.pdf
- https://static.usrfiles.com/ugd/73f3b0_d115b8ce8bea4c6a941f7c484f93ada8.pdf
- https://static.usrfiles.com/ugd/50c35f_55ef0e664ed643bbb0fe34be5859d19e.pdf
- https://static.usrfiles.com/ugd/edb4a7_003cdcf072924cb0a61a65bd5f71ec7b.pdf
- https://static.usrfiles.com/ugd/5a1791_e8dcef5396aa4894b686476b446f7742.pdf
- https://static.usrfiles.com/ugd/b8c837_1ce5c42005af4c70bb00e2326beefddc.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000672f.bin` `90416f796753363ce48066d6b0cec19d989833744584a4047b146623de9519ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x672F	5168 bytes
`font_01_sfnt_off000078dc.bin` `c19394f5c5d4f95496c6aa20ba0af7d79035236f5802b488879dacf3e29ad9a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78DC	11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.