PDF malware analysis — malicious · e715aa0f590576f8

MALICIOUS

PDF

40.7 KB Created: 2020-07-29 18:31:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 82bf6da9889f8939c54708eaef2d9e4d SHA-1: fe4c7e6aade59932048cc08edd7a7bdfb472ab36 SHA-256: e715aa0f590576f852b252d071ad70aac8e21181618d7382f584007ab4771900

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to a redirector service (ttraff.cc) known for malicious activity. The document body, though heavily obfuscated, appears to contain keywords related to educational materials, suggesting a lure to disguise the malicious intent. The presence of numerous external links, including a link farm, indicates an attempt to drive traffic to potentially harmful sites.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=cambridge+checkpoint+science+textbook+1+pdf
- http://files.becomingsarh.com/uploads/1/3/0/7/130739567/3400932.pdf
- http://files.pilatesofweston.com/uploads/1/3/1/8/131856937/11e9435fdc0fdc8.pdf
- http://files.chitownlimos.net/uploads/1/3/1/1/131164387/viwaseru.pdf
- http://files.chitownlimos.net/uploads/1/3/1/1/13116438
- https://cdn.shopify.com/s/files/1/0433/5940/4197/files/2395822822.pdf
- https://cdn.shopify.com/s/files/1/0433/8198/1347/files/61950417595.pdf
- https://cdn.shopify.com/s/files/1/0434/2307/2412/files/tuloxelosaxaxi.pdf
- https://cdn.shopify.com/s/files/1/0433/9305/6933/files/sasuketigesozuwebobatov.pdf
- https://cdn.shopify.com/s/files/1/0434/4109/4817/files/jurabevexa.pdf
- https://cdn.shopify.com/s/files/1/0441/0313/9480/files/71629191175.pdf
- https://cdn.shopify.com/s/files/1/0433/3764/6245/files/22664227009.pdf
- https://cdn.shopify.com/s/files/1/0432/0090/5373/files/tavepaxutosevimeji.pdf
- https://cdn.shopify.com/s/files/1/0432/1925/5454/files/56766937259.pdf
- https://cdn.shopify.com/s/files/1/0434/9408/0677/files/tufuwa.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/23535065851.pdf
- https://cdn.shopify.com/s/files/1/0436/0021/6232/files/metumolesexom.pdf
- https://cdn.shopify.com/s/files/1/0439/6217/1550/files/98454181601.pdf
- https://cdn.shopify.com/s/files/1/0438/1786/1277/files/49350757561.pdf
- https://cdn.shopify.com/s/files/1/0437/3384/4119/files/14818754813.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005cc9.bin` `c3f89861477d3fd0dea3caa51cbf255aa8f47e958aaeda432eba9c3bad64c829`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5CC9	5672 bytes
`font_01_sfnt_off00006ff2.bin` `9c4819514d165b13c2918b032faf3efacbe9d8711ce4ca8372763b5c8a341f20`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6FF2	11248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.