PDF malware analysis — malicious · f0a5dfdf52600a0d

MALICIOUS

PDF

41.8 KB Created: 2020-09-08 08:24:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8e6eb1abbc2f8b135cfc54078eaed27b SHA-1: c5dc4b5eccbfcd022adf1e464654ed6de2ffb6ab SHA-256: f0a5dfdf52600a0df043825cd151442dc17d954bd777c5eb4c16a438ae3d1ace

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, many of which point to a URL that is flagged as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'goalkeeper gloves size guide' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The presence of numerous links to static.usrfiles.com, while some are benign, indicates a link farm strategy. No scripts were extracted, but the PDF structure itself is used to host the malicious redirection.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=children%2527+s+goalkeeper+gloves+size+guide+adidas
- https://static.usrfiles.com/ugd/b8c837_5cf8069f8c0d426ab0bcfc82345a14d2.pdf
- https://static.usrfiles.com/ugd/b8c837_a5a42b1e2bd64bd5809fbedd7ab6d539.pdf
- https://static.usrfiles.com/ugd/b8bbd7_38d448c74e4c4621a2f41ca7ea7a4b0e.pdf
- https://static.usrfiles.com/ugd/e4f6f0_fd796d3b390f4235922ff3d6a51794f5.pdf
- https://static.usrfiles.com/ugd/4aae87_3a5a4423cf4144998c74bc9e7741869d.pdf
- https://static.usrfiles.com/ugd/1849a1_ef43db0050c9495db95eac56fa9d16c7.pdf
- https://static.usrfiles.com/ugd/eed56f_172fafc80d864f2a96dab2eda14e8628.pdf
- https://static.usrfiles.com/ugd/b6bf5b_756c6085eaa24eebb980c812715ef6b4.pdf
- https://static.usrfiles.com/ugd/811c4f_28e2e812f0154a2a9a4c646136d4e982.pdf
- https://static.usrfiles.com/ugd/f390e7_778e46701b4046948a5529e68888c769.pdf
- https://static.usrfiles.com/ugd/10cedf_329cad65fcee473c958372c18a014011.pdf
- https://static.usrfiles.com/ugd/361f4b_0dfda57b95ad46499f1cf4697fbe97c9.pdf
- https://static.usrfiles.com/ugd/493135_ae3a01efc6014ebab026aece329a4f1e.pdf
- https://static.usrfiles.com/ugd/77d535_783f99c3d89e405bbbaa64e9569d675f.pdf
- https://static.usrfiles.com/ugd/0010c8_99610ba3bd9347ae9dc43b7e3cfec4c6.pdf
- https://static.usrfiles.com/ugd/8ac1ab_4489a3818f0d4f7b9e9e56f0b47a8705.pdf
- https://static.usrfiles.com/ugd/162fe6_11d07f053fec43e3a9265e31665c8b9c.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064ba.bin` `f8a4da31d7e43c57f79e9f13f19b9e84851bcd0a8fdfbc0821133734570e2699`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64BA	5332 bytes
`font_01_sfnt_off000076e3.bin` `abdce438b960c9fb1028e54ee10fbf8e5f63b3613f692c22b21a1dc9d9a3a782`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x76E3	10196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.