PDF malware analysis — malicious · eb3ae768f3037449

MALICIOUS

PDF

46.9 KB Created: 2020-08-31 04:48:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 88b7526d9a66b97a8ec9ae022fad0efa SHA-1: 1f377ea372cae391f2000118d98ea64f1aea51b9 SHA-256: eb3ae768f30374496f3324615fe650d45d0c1481acc351c3e9b2805b1a8b7f69

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with one identified as a malicious redirector. The heuristic firings indicate this is a link farm designed to distribute malicious content. The primary malicious URL identified is https://ttraff.ru/wix?keyword=recalentamiento+y+subenfriamiento+pd, which likely serves as a gateway to further malicious sites or payloads.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=recalentamiento+y+subenfriamiento+pd
- https://cdn.shopify.com/s/files/1/0437/3289/3857/files/delilexuzeduzuroturosunas.pdf
- https://cdn.shopify.com/s/files/1/0427/4647/8759/files/vedatepimazusatir.pdf
- https://cdn.shopify.com/s/files/1/0434/8693/7253/files/waves_murcury_bundle.pdf
- https://cdn.shopify.com/s/files/1/0433/2588/2520/files/mopumatogativigonupob.pdf
- https://cdn.shopify.com/s/files/1/0429/2476/9436/files/putawu.pdf
- https://static.usrfiles.com/ugd/67e251_aa87c9a0b52b45efaa4fd025f77a64dc.pdf
- https://static.usrfiles.com/ugd/b8c837_756280f7b4e343b4939720676291bbec.pdf
- https://static.usrfiles.com/ugd/5fd5c1_912cfec6bbbe4c199f992dd23cbffceb.pdf
- https://static.usrfiles.com/ugd/39cb9d_c01c5d1e14b04e52aa45dbb3c62c4a5f.pdf
- https://static.usrfiles.com/ugd/b8c837_83e238e609754ece8cb303595b7fac41.pdf
- https://cdn.shopify.com/s/files/1/0431/6574/5314/files/lurata.pdf
- https://cdn.shopify.com/s/files/1/0434/1966/4541/files/edit_text_in_acrobat_reader_dc.pdf
- https://cdn.shopify.com/s/files/1/0429/6101/0842/files/pezamavux.pdf
- https://cdn.shopify.com/s/files/1/0429/9656/4131/files/mepotaxupofaragefekakewiw.pdf
- https://static.usrfiles.com/ugd/b8c837_47b01ea49aa74de1afedc2d82526b3a0.pdf
- https://static.usrfiles.com/ugd/cfbfd2_19c43c738200406999515ac1dfe4a359.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000677a.bin` `0636b242c319a013c30b341324f1e73aa696e7ec86f4e5a76d6c7fa9c032ec4e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x677A	5432 bytes
`font_01_sfnt_off000079d4.bin` `526a8b410693f36c253a7174c50b614cf85dfd90b06ebfaa776bc1043b2e1112`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79D4	11280 bytes
`font_02_sfnt_off00009ea4.bin` `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9EA4	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.