PDF malware analysis — malicious · eaaa9aa8c29f2e92

MALICIOUS

PDF

64.0 KB Created: 2020-08-30 03:41:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4f6630293dccf85cf37787bd60d817be SHA-1: d4ce64e1e66ff696d7623cc6641061fd87d1255c SHA-256: eaaa9aa8c29f2e92dfe9328dde26491b0f97c37e24859f829bb9f39b65d6c8e3

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a malicious redirector link pointing to 'https://ttraff.cc/wix?keyword=urine+culture+report+no+significant+growth'. It also functions as a link farm, with numerous embedded links to other PDFs. The heuristic 'SE_URGENCY_LURE' suggests the document may contain language intended to create a false sense of urgency. The presence of a malicious redirector indicates an attempt to lead the user to a harmful destination.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=urine+culture+report+no+significant+growth
- https://static.usrfiles.com/ugd/f65518_3a0d63498a5f43b6aa57539e709440a7.pdf
- https://static.usrfiles.com/ugd/07e02c_39df2151407e41c3981ed2d97be7fa03.pdf
- https://static.usrfiles.com/ugd/b8c837_bfb518c5d59a49098f26597b10d0cccc.pdf
- https://static.usrfiles.com/ugd/ae059d_a65561cc9442460d8f26a2645a6e24f1.pdf
- https://static.usrfiles.com/ugd/b8c837_d6ded65ed64640508ddf66f5508659ab.pdf
- https://static.usrfiles.com/ugd/7ef0dc_ce249cb770c04ca98e884e79080ec037.pdf
- https://cdn.shopify.com/s/files/1/0441/0900/4952/files/97019551393.pdf
- https://cdn.shopify.com/s/files/1/0429/5573/5193/files/vomag.pdf
- https://static.usrfiles.com/ugd/735189_d0b9cded1e044c82857c0c28d265cce4.pdf
- https://static.usrfiles.com/ugd/6f53d7_1162cf211150419f834f077e385df7ad.pdf
- https://static.usrfiles.com/ugd/98857b_a86ef2c84a32439ea7b48027bebf5840.pdf
- https://static.usrfiles.com/ugd/b8c837_dcdcae093c5d4f0183a0be9bb8c53f65.pdf
- https://static.usrfiles.com/ugd/5926b4_25acf4dbcc3c4674862cf9ccf2dcf1bf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b8c837_d6ded65ed64640508ddf66f55

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000a7bb.bin` `c90f9a311e412500290f897dd1fcb24b223d6c17a94b649f4d626895866b290a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA7BB	5360 bytes
`font_01_sfnt_off0000ba02.bin` `f05c9492fa17488989a80df0d8c1dccbe95e2f2ac38a0123d520732fefd776f9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBA02	10288 bytes
`font_02_sfnt_off0000dd5d.bin` `3aad8f736d68201c4a8387338ab5b73e899d8d5dbdf6ead162eb48e90402f37f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD5D	16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.