PDF malware analysis — malicious · e14ee2a5c14b6d70

MALICIOUS

PDF

54.7 KB Created: 2020-09-06 00:44:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 66713b93c73a5b57c83c7190d410141f SHA-1: 494128aaf860408f5788410afd58ee93e914cfc6 SHA-256: e14ee2a5c14b6d70eeb125292dd2964bbfe20852166890a03871b16c4f98a9bb

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/wix?keyword=iloilo+to+boracay+travel+guide'. This URL is embedded within the document body, disguised as a travel guide. The file also exhibits characteristics of a link farm, with numerous embedded URLs, many pointing to static.usrfiles.com. The primary malicious IOC is the redirector URL, which likely leads to further malicious content or phishing attempts.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=iloilo+to+boracay+travel+guide
- https://static.usrfiles.com/ugd/6908d7_c3acbd6076bb40b8bd9753cd966429cb.pdf
- https://static.usrfiles.com/ugd/60933b_7b9a66139d794f64b19f3eaed8dba83e.pdf
- https://static.usrfiles.com/ugd/9c43ec_eec676e5f9604b31a88c1ff304d242cb.pdf
- https://static.usrfiles.com/ugd/9421c8_2e7aaba511914b2facc61dea8749202e.pdf
- https://static.usrfiles.com/ugd/0ebc1f_4735a64e61174d7b8f87d61c11bbed21.pdf
- https://static.usrfiles.com/ugd/d99ef3_3f0ed0c977734075bd8178e23ede3def.pdf
- https://static.usrfiles.com/ugd/b85eb0_c013b2001edd4d079b449d8c8f3a4f1c.pdf
- https://static.usrfiles.com/ugd/3bf302_1d2351e0118343eeb9db1c185fbb589a.pdf
- https://cdn.shopify.com/s/files/1/0432/0677/0849/files/the_bolsheviks_come_to_power.pdf
- https://cdn.shopify.com/s/files/1/0428/1021/2518/files/excel_repeat_last_action.pdf
- https://cdn.shopify.com/s/files/1/0432/2882/3719/files/clothes_adobe_illustrator_templates_free.pdf
- https://cdn.shopify.com/s/files/1/0435/1403/6383/files/23161995962.pdf
- https://cdn.shopify.com/s/files/1/0436/3167/3502/files/62155913968.pdf
- https://static.usrfiles.com/ugd/11276f_8ee3172a77b64e868369d781d1a5e1ad.pdf
- https://static.usrfiles.com/ugd/f59309_da2b86af379740e38c9896a3103e650f.pdf
- https://static.usrfiles.com/ugd/740d8c_712c39cc1aca45ecad0c577e3afd2a8c.pdf
- https://static.usrfiles.com/ugd/04e6f9_9e81515a71e54c698c5c4162fbecf750.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000099a4.bin` `ed5625528eaf48fb1d34ee309e312adc2aba64d79411fc2f83711992b7c039be`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x99A4	5168 bytes
`font_01_sfnt_off0000ab52.bin` `03a776d09bec7c4d120aa664553f446a0104e4b778746095d15a4dbd4a6bba9c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAB52	10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.