PDF malware analysis — malicious · ea4bd87b02939a13

MALICIOUS

PDF

42.8 KB Created: 2020-09-05 17:10:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 83b2413bbec302da2a05de5d7e5d4404 SHA-1: 4a67f9cd72b656d6ba1fb1bcead2a73d69429956 SHA-256: ea4bd87b02939a13ec1817e2dbe8162812750d55036ea7f3c59679fe806c0ce8

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link farm designed to redirect users to malicious infrastructure. The primary malicious URL, 'https://ttraff.club/pify?keyword=math+worksheets+grade+3+to+print', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains references to 'math worksheets' and the malicious URL, suggesting a lure to disguise the malicious intent. The presence of numerous links to static.usrfiles.com, while individually benign, contributes to the overall SEO manipulation tactic.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=math+worksheets+grade+3+to+print
- https://static.usrfiles.com/ugd/b8c837_f4f5f3787226410ea63105508b12721c.pdf
- https://static.usrfiles.com/ugd/61f964_20b61707f1e34824a062429eec04b6e4.pdf
- https://static.usrfiles.com/ugd/aa14a9_a6a19e4ac08d47649f036f20811c1a17.pdf
- https://static.usrfiles.com/ugd/eb5a6a_0401bed38e014edf94011f9963472355.pdf
- https://static.usrfiles.com/ugd/88a84f_57b02927953643c299cedd8afc0aa658.pdf
- https://static.usrfiles.com/ugd/9c0842_b3219524ef684936a30e8ccec5950b1b.pdf
- https://static.usrfiles.com/ugd/665c20_9f7e4d556d674951be54b898dbaa3bb7.pdf
- https://static.usrfiles.com/ugd/ace02d_5cbe82f96d7f41ccaf676439c236ea08.pdf
- https://static.usrfiles.com/ugd/99afdc_43b8fcd7798f45779c738afbdd5c1c32.pdf
- https://static.usrfiles.com/ugd/6fd45c_714748efb6134f0295c10bae415081cf.pdf
- https://static.usrfiles.com/ugd/32777b_a79e339629f74c3ba1d1659b210855a7.pdf
- https://static.usrfiles.com/ugd/48d9a1_4cc3104b48e745afa24364d452b5329a.pdf
- https://static.usrfiles.com/ugd/b8c837_a21b72bb2cfa43b981a0160bcc6d9be2.pdf
- https://static.usrfiles.com/ugd/24853a_f5d53973ac9b469f8c825b5f0dcf8b5b.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006840.bin` `603d6c41d005579b42831663e463e990f73478b292f55ab34936905f59b1be25`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6840	5516 bytes
`font_01_sfnt_off00007b17.bin` `666ee2a49612494fa4e83b566425d6e3549d3ff59cd6a8d495ca908fb1ce84bf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B17	10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.