PDF malware analysis — malicious · f02a6ed099d25eea

MALICIOUS

PDF

38.9 KB Created: 2020-08-30 09:24:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8366e003fed78bcbd188a6ea3e49874f SHA-1: 38d44643257982dbe4763b0cb02685b7624db4f6 SHA-256: f02a6ed099d25eeab22908d524371d3a0f9bba94412b0907c86fd1a9b7aa5b7c

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm and a direct link to a redirector, disguised as a download for 'Harrison's manual of medicine 19th edition pdf'. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK indicates the primary link leads to known malicious infrastructure. The PDF_SEO_LINK_FARM heuristic suggests a large number of outbound links, likely for SEO manipulation or to host further malicious content. The presence of a visual download button lure further supports a social engineering attack.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=harrison%2527s+manual+of+medicine+19th+edition+pdf
- https://static.usrfiles.com/ugd/fe83c3_79cc892f3cd74339a2394c8598c12990.pdf
- https://static.usrfiles.com/ugd/d4a9d6_e0dc9088c59f42299c55d45f69f904e2.pdf
- https://static.usrfiles.com/ugd/b8c837_5ef1c7640ec44b888fef8b6112cae54d.pdf
- https://static.usrfiles.com/ugd/b8c837_30bda6cbade347fe9b4b4577d96426f8.pdf
- https://cdn.shopify.com/s/files/1/0434/0128/1701/files/50541013020.pdf
- https://cdn.shopify.com/s/files/1/0431/5725/8395/files/cloudformation_ec2_template.pdf
- https://cdn.shopify.com/s/files/1/0431/4028/4583/files/calculus_and_analytic_geometry_key_book.pdf
- https://static.usrfiles.com/ugd/b8c837_c42a3941ec6a42f4ada1f34b21746e93.pdf
- https://static.usrfiles.com/ugd/b8c837_ab2d59f632084276a5dc9f2cc36a11ed.pdf
- https://static.usrfiles.com/ugd/1f5cef_fb6a0b5817994c9a9defa98c659cb96a.pdf
- https://static.usrfiles.com/ugd/b8c837_f6f01d067cf54a63b6bc79927bb47493.pdf
- https://static.usrfiles.com/ugd/b8c837_25f619fe66cf499da623bac0f75446b7.pdf
- https://static.usrfiles.com/ugd/2b25b5_5ce951ff1df04becbdd29c9c175ba3a1.pdf
- https://static.usrfiles.com/ugd/f3ecbe_37dfa9446f3545589200800243423859.pdf
- https://static.usrfiles.com/ugd/451461_cf812c65d4eb4db1960c096e9414f587.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000058bf.bin` `1d8f2364822b066156a5300e09dbc46e0227fc9cd92ed74e8d22cef5959189c0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x58BF	5596 bytes
`font_01_sfnt_off00006ba1.bin` `df88caf99346e2daa1107317b36504eea17647d98102821e481923003b3b86a0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6BA1	10208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.