PDF malware analysis — malicious · f11ed93e1a1e3908

MALICIOUS

PDF

69.2 KB Created: 2020-08-10 08:07:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7aa49afb0bc5280e66d8b2570de61b0e SHA-1: 7ef4b85afa8cb30a961b51ada725fa315e7e3be0 SHA-256: f11ed93e1a1e390897c9ef42f5566f62744ded0ea7f8dbc749d018bd35423df2

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.com'. This URL is embedded within the document body, disguised as a download link for a calculus textbook. The presence of numerous other external PDF links, many hosted on Shopify, suggests a link farm or SEO poisoning tactic to drive traffic to the redirector. The primary intent appears to be directing users to malicious infrastructure under the guise of providing a requested document.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=calculus+early+transcendentals+3rd+edition+pdf+download
- http://liwir.spillwaycollective.com/uploads/1/3/2/8/132814930/a109ccaa04.pdf
- http://files.dancefixx.com/uploads/1/3/0/7/130775649/6063277.pdf
- http://romov.giftsbygriff.com/uploads/1/3/0/7/130776257/xesanipusal.pdf
- https://cdn.shopify.com/s/files/1/0433/6317/2502/files/lizajoluzibajeg.pdf
- https://cdn.shopify.com/s/files/1/0429/1713/4499/files/asteroids_in_astrology.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/wopeg.pdf
- https://cdn.shopify.com/s/files/1/0437/4714/7928/files/bujetusasuxamapujo.pdf
- https://cdn.shopify.com/s/files/1/0429/8702/8641/files/daleb.pdf
- https://cdn.shopify.com/s/files/1/0433/3702/3641/files/usmc_drill_manual.pdf
- https://cdn.shopify.com/s/files/1/0430/0147/9321/files/35310573785.pdf
- https://cdn.shopify.com/s/files/1/0429/6821/9799/files/51759879394.pdf
- https://cdn.shopify.com/s/files/1/0434/5715/1129/files/96133854102.pdf
- https://cdn.shopify.com/s/files/1/0427/7790/3263/files/24157999186.pdf
- https://cdn.shopify.com/s/files/1/0434/1468/3813/files/71611833097.pdf
- https://cdn.shopify.com/s/files/1/0431/7052/9436/files/bakogejajori.pdf
- https://cdn.shopify.com/s/files/1/0435/4431/4024/files/jimogisododeke.pdf
- https://cdn.shopify.com/s/files/1/0440/8328/2070/files/axar_publication_maths_book.pdf
- https://cdn.shopify.com/s/files/1/0435/1338/1028/files/79459246941.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cf67.bin` `37ee11c6429d23fc455d659ef5889d28554bfa8cdb652bfdd7ec667c4b9e762b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCF67	5412 bytes
`font_01_sfnt_off0000e1f1.bin` `0ebc9c335d6388d428d379c8182166539d80c9fb1f0546b51a881ec49e10983a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE1F1	10692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.