PDF malware analysis — malicious · e4eabf836a629514

MALICIOUS

PDF

85.1 KB Created: 2020-09-06 23:48:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ff39d5807db15712de5759a77e33cb6d SHA-1: 35e0295d267058e294f40a273902f8a798df9b37 SHA-256: e4eabf836a6295146bcd6a960764b1a7a34e9ce28e228d5d8d3bd4296268c0ca

128 Risk Score

Malware Insights

MITRE ATT&CK

T1200 Hardware Add-in T1566.002 Spearphishing Attachment T1059.001 PowerShell T1059.003 Windows Command Shell

The PDF file contains a link to a known malicious redirector, ttraff.com, which is designed to lure users to malicious websites. The presence of a 'download button' heuristic further supports the social engineering aspect of this attack. The document body contains obfuscated text and a URL, indicating an attempt to disguise the malicious intent. The file was generated by wkhtmltopdf, which can be abused to create malicious PDFs.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=cyanogenmod+7+rom
- https://static.usrfiles.com/ugd/a2e20a_4cd0bb4a92ef40a59e6d6fc4b6929d77.pdf
- https://static.usrfiles.com/ugd/60e703_3194042630754c5088e9903692f1f496.pdf
- https://static.usrfiles.com/ugd/374ce0_6cd52342bee84617b362c0c5463be64c.pdf
- https://static.usrfiles.com/ugd/3b0c81_dfb9d23fa1bc4cbf9307db5d9ee6335d.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/boruxunijutaki.pdf
- https://cdn.shopify.com/s/files/1/0431/7013/6220/files/briggs_and_stratton_550_series_manual.pdf
- https://cdn.shopify.com/s/files/1/0436/9511/2347/files/around_the_world_in_80_days_board_game_rules.pdf
- https://static.usrfiles.com/ugd/3eed2b_b70ac7cfefab4958a9ea4c38271ed499.pdf
- https://static.usrfiles.com/ugd/eaf48f_d60554a539734a4999886e3b05bba19b.pdf
- https://static.usrfiles.com/ugd/3649d2_6a2f96bf46184c27b077550663303516.pdf
- https://static.usrfiles.com/ugd/136d07_83f1178494a94b2eb9801134596433f4.pdf
- https://static.usrfiles.com/ugd/c1108c_ffa4b0ecb3a646a4b0dcc8430d20a7ee.pdf
- https://cdn.shopify.com/s/files/1/0438/9103/2216/files/38013193189.pdf
- https://cdn.shopify.com/s/files/1/0437/6100/8791/files/disadvantages_of_discussion_method_of_teaching.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010d8d.bin` `23e8ba7910d42d5288da5441d80a44112ae6952fb24cfb05ceb67ab9612c947a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10D8D	5024 bytes
`font_01_sfnt_off00011e9b.bin` `eb478dd86c7f43b8076440e0464fa9edba3f22ce2aa1735fd764658c6afbda5a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11E9B	12044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.