PDF malware analysis — malicious · ea8b384baf1f846e

MALICIOUS

PDF

40.4 KB Created: 2020-08-31 15:48:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e168db9678b9cf25c59acce5bd483a20 SHA-1: 1dad09388fd5a25e679bcb04fdb140908e1ff244 SHA-256: ea8b384baf1f846efc63b0d2c3d63939a7b2f00eeab8bcbe195a3b2f9518bfc8

130 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to a URL that is flagged as a malicious redirector. The document body also contains a call-to-action phrase, suggesting a lure to click on these links. The primary malicious URL identified is https://ttraff.me/wix?keyword=twitter+video+er+iphone+camera+roll, which is likely used to deliver a secondary payload.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=twitter+video+er+iphone+camera+roll
- https://static.usrfiles.com/ugd/ae15ca_12be846eef5a4fe7a0c7c1d928f668ef.pdf
- https://static.usrfiles.com/ugd/b8c837_a0d18e1d31a144499ac6cd3312e8d183.pdf
- https://static.usrfiles.com/ugd/c162b3_20f18c82bef7469daf51fe25716bce5b.pdf
- https://static.usrfiles.com/ugd/b8c837_f9ecb95da166493db45109e36c10740a.pdf
- https://static.usrfiles.com/ugd/1d64af_04f101bac8544e0aab0af7b95d66c704.pdf
- https://static.usrfiles.com/ugd/9d66c7_32c84cc3feff4e7ca41c86c1990736d1.pdf
- https://static.usrfiles.com/ugd/2f7815_34f9774b4a8f4b4c8a73710fd63bae5e.pdf
- https://static.usrfiles.com/ugd/ef253e_6beb0c7b7a884927a5924beb294493f5.pdf
- https://static.usrfiles.com/ugd/b8c837_8f8ef4fdabd7440c9452d65214075379.pdf
- https://static.usrfiles.com/ugd/cbe7f7_6a38c8889fea4e9182359312065b2677.pdf
- https://static.usrfiles.com/ugd/89064d_57723d07006742dba2d1ec87f612aaee.pdf
- https://static.usrfiles.com/ugd/76156b_4d037a2c7cd14605b7683af8efbd4a74.pdf
- https://static.usrfiles.com/ugd/b8c837_50fe117e663543b1a93ec9e9748e6e84.pdf
- https://static.usrfiles.com/ugd/66c878_750941cc835f46938e2babbcbda428d0.pdf
- https://static.usrfiles.com/ugd/b8c837_5f9c85f70c984a9ea71bcdac4e2a5f33.pdf
- https://static.usrfiles.com/ugd/98857b_fc7fda3f38d844a7a18a1e69a2464ba5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f90.bin` `f0d9d2b4afa616abfd02c094c517a718e1882730770d33739251f333703b0ebf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F90	5236 bytes
`font_01_sfnt_off0000714d.bin` `d1eb263af8be3b36709a0a7a2a7161caba606c98f6a73c325099e06c44a003e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x714D	10276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.