PDF malware analysis — malicious · f23ef7ac9d263f61

MALICIOUS

PDF

33.3 KB Created: 2020-09-05 02:40:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8966fde35d37077c476ba9e5c9929e15 SHA-1: 834cd0f9f9cd47736c986050b6420f346a2ec9a8 SHA-256: f23ef7ac9d263f61f44dbdb22bdece14f097d77d596c36d71fdd69fd6945233b

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.001 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a heuristic firing for a malicious redirector link, which is also present in the document body. The document also contains a heuristic for a 'browser extension/update installation lure', indicating a social engineering attempt. The presence of numerous links to external PDFs, many hosted on static.usrfiles.com, suggests a link farm designed to attract traffic or potentially host further malicious content, though many of these specific URLs were marked as benign. No scripts were extracted from this sample.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=aversions+crown+parasites
- https://static.usrfiles.com/ugd/cece23_174a8dcd9ac74ad9b4d1de9f88d2bde3.pdf
- https://static.usrfiles.com/ugd/83e24f_ebe57cb11e7247919f0ce27ca26e9611.pdf
- https://static.usrfiles.com/ugd/9b5f63_8cd97618b2a848619ca8005a8cfd941b.pdf
- https://static.usrfiles.com/ugd/b8c837_1d50b7e52fc346ba9299f91c652bb6f6.pdf
- https://static.usrfiles.com/ugd/73cb9e_29945c73e74948f0963fd7f8be3dfbd5.pdf
- https://static.usrfiles.com/ugd/7cefa9_4704d3b0f0b04038a79a6045f223a64e.pdf
- https://static.usrfiles.com/ugd/b8c837_de221f358af14cefb7bdd19a92485e94.pdf
- https://static.usrfiles.com/ugd/0049ca_ae28737b268942ffa4f5a2167310fd3a.pdf
- https://static.usrfiles.com/ugd/a4c1fa_f0ca3250baa045d4ae62a7c85cc32039.pdf
- https://static.usrfiles.com/ugd/01bc73_2a0987d9dbf1402885c2750d7934923e.pdf
- https://static.usrfiles.com/ugd/c0518c_f42762e9248e4c2cafefb60aa06300b9.pdf
- https://cdn.shopify.com/s/files/1/0434/0157/6604/files/volevotivane.pdf
- https://cdn.shopify.com/s/files/1/0440/1784/4382/files/6286164703.pdf
- https://cdn.shopify.com/s/files/1/0459/9568/8093/files/gotukagolokakofabikare.pdf
- https://cdn.shopify.com/s/files/1/0431/8127/7342/files/46430194133.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004494.bin` `d6bbbdd2fe91fba71d70e772ed6048eb756c0340079ea71d93346fc41499c485`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4494	5036 bytes
`font_01_sfnt_off000055dd.bin` `68af0c8570c813c2336678be06a1adeff3c50d8c56103bcb4b0fdad65bbfcccd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x55DD	10340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.