PDF malware analysis — malicious · e369c8e7da96ec5d

MALICIOUS

PDF

42.3 KB Created: 2020-08-31 11:32:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fe405b46504b6cbd6d107def25d541a0 SHA-1: df3144bce651120d2609b7f56d516fbbf343c2b0 SHA-256: e369c8e7da96ec5dab96bfd069166b873cb252555377872db2f4adad8d1d730f

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, directing users to 'https://ttraff.cc/wix?keyword=ez+go+powerwise+qe+battery+charger+manual'. This indicates a social engineering attempt to trick users into visiting a potentially harmful site. The document also exhibits characteristics of a PDF SEO link farm, embedding numerous links to other PDF documents, likely to manipulate search engine rankings or distribute further malicious content. No scripts were extracted from this sample.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=ez+go+powerwise+qe+battery+charger+manual
- https://static.usrfiles.com/ugd/f09a9d_ec19e95cd7f645b7b22b994f943ab8bf.pdf
- https://static.usrfiles.com/ugd/7f16bd_6fe6163f56974e9eac21bea76ad82e54.pdf
- https://static.usrfiles.com/ugd/3bcfef_ed6774e84b324922b62760c4d64a817b.pdf
- https://static.usrfiles.com/ugd/b8c837_849ea72b66b94d2296ea6375bc26e85b.pdf
- https://static.usrfiles.com/ugd/de65f7_bbb2eaf9824e47d9ae0cca5510196c15.pdf
- https://static.usrfiles.com/ugd/b8c837_5769e1b7c6f04deabef1f2ef0e60a801.pdf
- https://static.usrfiles.com/ugd/b8c837_92c89f0ed4484e788e34c4f08e9f3aa5.pdf
- https://static.usrfiles.com/ugd/09273f_2cccb36819d44ce89a80cc384cb1a47c.pdf
- https://static.usrfiles.com/ugd/9421c8_4ed27f5f2eec45fb9c29d643bb6477d4.pdf
- https://static.usrfiles.com/ugd/b8c837_c4b38093ee154f2188d50831291210bc.pdf
- https://static.usrfiles.com/ugd/cc14e4_0b3fe60201eb4b5589fefb6e304f96b5.pdf
- https://cdn.shopify.com/s/files/1/0438/6881/5528/files/mugen_family_guy.pdf
- https://cdn.shopify.com/s/files/1/0429/6713/8470/files/vector_dot_product_and_cross_product_example.pdf
- https://cdn.shopify.com/s/files/1/0430/7052/1495/files/purebegejilolemoz.pdf
- https://cdn.shopify.com/s/files/1/0432/4727/2098/files/21620910546.pdf
- https://cdn.shopify.com/s/files/1/0433/5036/0232/files/makeup_logo_template.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005dc3.bin` `edbb5ff876a3db4354fc450acc5b597b8ee0ac62ec6f9af58a521f94e6ef673f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5DC3	5816 bytes
`font_01_sfnt_off0000718c.bin` `ee2bfad0f3ec53248aaab2d17403070a9a14e5a4e00ebe3e25db2436b707006c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x718C	13500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.