PDF malware analysis — malicious · e55a63118c2a572b

MALICIOUS

PDF

50.5 KB Created: 2020-09-01 15:10:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 445d9dc422394e37095eef49f46a28f9 SHA-1: 4ebaa361663353a5aabc8d83e567eb79a3112720 SHA-256: e55a63118c2a572b269bb171667085235382a5ae096c7f2c36fc18991bf9abed

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, with one specifically pointing to a known malicious redirector. The document body, though partially corrupted, includes the URL 'https://ttraff.com/wix?keyword=whatsapp+stickers++free+ios', suggesting a lure to a malicious site. The heuristic firings confirm the presence of a malicious redirector link and a link farm, indicating a phishing or redirection attempt.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=whatsapp+stickers++free+ios
- https://static.usrfiles.com/ugd/b8c837_dd5307d50f8c420bb8eef6f98dc113ef.pdf
- https://static.usrfiles.com/ugd/b8c837_d4b78f0c91ff4000a4e5cf4d52f44875.pdf
- https://static.usrfiles.com/ugd/efb3f0_84e4829aa58046f29a9fdab3b6ed66a0.pdf
- https://static.usrfiles.com/ugd/cfa91a_c8440fc079224588bb1604726d0855c7.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/78108387577.pdf
- https://cdn.shopify.com/s/files/1/0432/0316/6372/files/kC3BCfC3BCrlC3BC_telefon_C59FakasC4B1_indir.pdf
- https://cdn.shopify.com/s/files/1/0430/5453/0709/files/2994997754.pdf
- https://cdn.shopify.com/s/files/1/0436/1581/3795/files/31012110106.pdf
- https://cdn.shopify.com/s/files/1/0428/0408/4899/files/chemistry_jamb_past_questions_and_answers_2018.pdf
- https://cdn.shopify.com/s/files/1/0428/7427/3948/files/anderson_public_policy_making_7th_edition.pdf
- https://cdn.shopify.com/s/files/1/0434/4207/7852/files/attractive_man_conversation_cheat_sheet.pdf
- https://cdn.shopify.com/s/files/1/0435/6849/6798/files/osmosis_worksheet_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0435/3638/4159/files/64822201768.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006497.bin` `8d3f4f54fae7715de8ea0bc781c1a174e34bb58835c09a7c572a2820d1b343bc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6497	5148 bytes
`font_01_sfnt_off00007625.bin` `5f505ddb1e21cc22cb367b35b870bdb86131ba9556f7f0fadcb3371511015c23`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7625	10384 bytes
`font_02_sfnt_off000099cf.bin` `04f7f01f0e81293101bff3dd2fde270aec15dc769f0ca1dde224ef3aeb45275a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x99CF	16428 bytes
`font_03_sfnt_off0000afe9.bin` `a2d2a73b31f614169c909b1bb91d4aa96e97aaa5bd1dbabfed78e01997b6b1f8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAFE9	3204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.