PDF malware analysis — malicious · f345e2f74b46a0a4

MALICIOUS

PDF

41.2 KB Created: 2020-09-02 16:20:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3e65574c9381e19196f3203a9cc24231 SHA-1: 757abc3a679d3ab25c32b9ca1cd013e529859dcf SHA-256: f345e2f74b46a0a44e6c97199d11145618b3137663008c1a5047c71de0362959

160 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a prominent link disguised as a technical guide, which is a common social engineering tactic. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK indicates this link leads to known malicious infrastructure. The SE_CLICKFIX heuristic suggests the document may also contain instructions to bypass security measures by tricking the user into executing commands, further supporting a malicious intent.

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClickFix social engineering attack high SE_CLICKFIX

Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/pify?keyword=microsoft+hyper+v+server+2016+installation+guide
- https://static.usrfiles.com/ugd/906e9f_0f50dd2a72be4a3c869d18e326cd04ff.pdf
- https://static.usrfiles.com/ugd/5926b4_fc1dfd923aed46219b6f5a7e7ee55e22.pdf
- https://static.usrfiles.com/ugd/8b9728_9a835facadff4114a19d2fba83fe2658.pdf
- https://static.usrfiles.com/ugd/c0a468_9326fbef77fe4ebb82899b781a7c8521.pdf
- https://static.usrfiles.com/ugd/b8c837_86b3e735cce247c796b4d063db64c3de.pdf
- https://static.usrfiles.com/ugd/4f270c_a087a2dd617947d58a6e93bae72b01d7.pdf
- https://static.usrfiles.com/ugd/7c30af_519542a585d94fa197e5e0c991685e41.pdf
- https://static.usrfiles.com/ugd/b8c837_620011206012453e89e1da7d9a111f2b.pdf
- https://static.usrfiles.com/ugd/b916f4_b811db3865a541fea56dd6d2ea780b42.pdf
- https://static.usrfiles.com/ugd/3fc21f_0741ed2e421449faa7b31962cb7b475e.pdf
- https://static.usrfiles.com/ugd/b8c837_efecfac215454b0e9be89bf658fd3c9b.pdf
- https://static.usrfiles.com/ugd/bd5c68_2d39f686348848dda58ecaf449fc3c52.pdf
- https://static.usrfiles.com/ugd/0dd040_07672b3b11c7491c893e5dc4d81da249.pdf
- https://static.usrfiles.com/ugd/3b5dd9_74135482294841ceb1f34ab886ba6d6f.pdf
- https://static.usrfiles.com/ugd/455f95_1437a63ea5d44432945b8b37a9b527d5.pdf
- https://static.usrfiles.com/ugd/097bd5_7e8e10d9a97d433eab333404dcb31780.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f9c.bin` `11888e956ede79ef35d49acfec0fbbafb1b8558e7f240ea0639779becc0e0d6f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F9C	6064 bytes
`font_01_sfnt_off00007459.bin` `9199598210b5e26cfff4856bf1079953e41c706e5f7449436b248ed53f5e3f87`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7459	10384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.