PDF malware analysis — malicious · ef0bc6720f3e563a

MALICIOUS

PDF

44.4 KB Created: 2020-08-30 16:41:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ffc4ddb9a5c03af745ebeffabdf67f7a SHA-1: 01c010e48134395b6dd02e2aca598b67131380bd SHA-256: ef0bc6720f3e563ad691630e2211fb7970c3d645468676dda5eabb64d3aca425

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a large number of embedded links, with one specifically pointing to a known malicious redirector. The document body, though heavily obfuscated, contains text related to a study guide and the malicious URL. This suggests a social engineering attempt to trick users into visiting the malicious site, likely for phishing or to download further malware.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=best+hesi+a2+study+guide+2018
- https://static.usrfiles.com/ugd/191a6d_17ca03616424465d87a64a6b6bd062ca.pdf
- https://static.usrfiles.com/ugd/b8c837_757eb45f7b604307b38eaf564db98e1c.pdf
- https://static.usrfiles.com/ugd/b8c837_6f53ec0b69594ddd80c7ee7099861fe4.pdf
- https://static.usrfiles.com/ugd/3aca14_d0e9b9696fa54f1fba6dc2ce6dc8c8b5.pdf
- https://static.usrfiles.com/ugd/ef7b09_6b450098ec004c029bf0eba9f5345725.pdf
- https://static.usrfiles.com/ugd/87fdc7_f88af02a73de4bc9a0fe8f8d84c1ccff.pdf
- https://static.usrfiles.com/ugd/b8c837_0ecead672ada402a9e1b088dc14511e0.pdf
- https://static.usrfiles.com/ugd/b8c837_d4e704b806b04769b2819c20efdb9da9.pdf
- https://static.usrfiles.com/ugd/b8c837_e5ee22d5d4194382b5ba869f65d86ee1.pdf
- https://static.usrfiles.com/ugd/bfbc46_48a73cd60eea46a79b3ff99454d22661.pdf
- https://static.usrfiles.com/ugd/b8c837_c1c1b08528504a6386fbecff564c815f.pdf
- https://static.usrfiles.com/ugd/b8c837_60f941783ff54948925393a1e465d837.pdf
- https://static.usrfiles.com/ugd/b8c837_81d6cfd329e64264b50046d6bdef5274.pdf
- https://static.usrfiles.com/ugd/b8c837_85da2e815a04463ca0461b7aa322d485.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006223.bin` `25228ab2166fdef2aa0863fc6a8415c9219d589a5f1c311c5273ac679fa6c8ec`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6223	5296 bytes
`font_01_sfnt_off00007438.bin` `435f4d82dc54e8780fbc847d3af3c5292633d83a1692f8b2841c43261dbb76d0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7438	10208 bytes
`font_02_sfnt_off000096f4.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x96F4	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.