PDF malware analysis — malicious · e4c7be587500718b

MALICIOUS

PDF

46.5 KB Created: 2020-09-01 03:44:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5fafd6cb9d4a706ac93cacbda7c1371d SHA-1: 9dd174bee9b3e3c041d0251a9003425a33faf28f SHA-256: e4c7be587500718b0a5b8e0e0b4bafcf44bb5e92c4814e99b9453c6819551c6d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a mass of external links, with one critical heuristic identifying a link to a known malicious redirector. The document body, though heavily obfuscated, contains the URL https://ttraff.cc/wix?keyword=kasturirangan+report+on+education, suggesting a lure to a malicious site. The presence of numerous links to static.usrfiles.com, while marked as benign, indicates a link farm strategy. No scripts were extracted, but the PDF structure and link redirection strongly suggest a phishing or malware delivery attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=kasturirangan+report+on+education
- https://static.usrfiles.com/ugd/b8c837_f60e6bf37bba49bab33a35556f3a8162.pdf
- https://static.usrfiles.com/ugd/3de8a6_6b10877542ae4ebe9b170dba9d7c0aac.pdf
- https://static.usrfiles.com/ugd/b8c837_6496ba0ea7e0410296fce502a7dc1e01.pdf
- https://static.usrfiles.com/ugd/de3d83_ac49af9eb1314e388eb8da0fa1bce15f.pdf
- https://static.usrfiles.com/ugd/b8c837_3382137978224093a2596f2a0e44a9c1.pdf
- https://cdn.shopify.com/s/files/1/0437/1975/3879/files/antennas_download_free.pdf
- https://cdn.shopify.com/s/files/1/0430/8841/2836/files/16244593179.pdf
- https://static.usrfiles.com/ugd/b8c837_49da743799404ec9a93ab82ac4ff7145.pdf
- https://static.usrfiles.com/ugd/4e6dd5_c848b4572e394141aed839ea43e56ee8.pdf
- https://static.usrfiles.com/ugd/b8c837_715b3b0863494b5c9aad156621a73024.pdf
- https://static.usrfiles.com/ugd/0d002d_1a7d32c17f6a4df3825198cc81b9d9e6.pdf
- https://static.usrfiles.com/ugd/b8c837_03f51cecd1f14850b602826146c68541.pdf
- https://static.usrfiles.com/ugd/23e9be_96471565bcaf4bc99740bde96aab6364.pdf
- https://static.usrfiles.com/ugd/eb4c03_094a4f1b399a41e8adffbfac72dd0d45.pdf
- https://static.usrfiles.com/ugd/b8c837_92636154c2234b04bc6406555cb7d128.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/4e6dd5_c848b4572e394141aed839ea

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a5e.bin` `012cb36b5959936eed7a30bae560956d14939f632bef5187fff0b72884821331`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A5E	5176 bytes
`font_01_sfnt_off00007c09.bin` `5c558618dff369c2b900462a2c05a26cd535293f5b4c043723e2c7e55145be0c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C09	2884 bytes
`font_02_sfnt_off00008815.bin` `673948208b4e01459078b359be62936c0226a858e5ab5226e18482b5e9160592`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8815	10588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.