PDF malware analysis — malicious · f9e266f96ba6baea

MALICIOUS

PDF

39.6 KB Created: 2020-09-16 16:53:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 63f163b173c04adf896413e4371a8271 SHA-1: 2f5eb229ab5ab50d94dc50b871583172a1d987d4 SHA-256: f9e266f96ba6baea836b1c84bed360ae78264ce29b0afdaa2fc2e8c654f34267

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm and a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains the URL https://ttraff.me/wix?keyword=everyday+mathematics+volume+1+answer+key, which is likely intended to lead the user to malicious content. The presence of numerous other PDF links suggests a link farm designed to improve SEO for malicious sites or to distribute further malicious content.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=everyday+mathematics+volume+1+answer+key
- http://xudop.anzonaconference.net/uploads/1/3/0/9/130969521/rujizer.pdf
- https://03916d10-1e80-4ef7-ab59-d0693fe75f39.filesusr.com/ugd/c1de29_33f8664d9a374e87bff5311ca7399d88.pdf?index=true
- https://5acef51e-3035-43f4-8e2d-ee560377190a.filesusr.com/ugd/384ea4_0313c60b27f3441dbce8aa2e03260195.pdf?index=true
- https://46039034-48c5-4416-99e8-e55656da1457.filesusr.com/ugd/3f80ec_f87efc5bd78844abba562fcaf7d8a9b8.pdf?index=true
- https://cd116e25-3da1-409f-b1ee-6d1c32635add.filesusr.com/ugd/f4de5e_b28b92bbd61c4771a8f67df38e57ba62.pdf?index=true
- https://8467e83a-813c-4841-b3ac-25c39c9c7dc0.filesusr.com/ugd/a4ea6c_7674b63a42f9468a8560dff954744220.pdf?index=true
- https://560535e6-3980-4a8f-bd55-772296553591.filesusr.com/ugd/3a38e0_0ace9de55c294d299a1faa4744541e43.pdf?index=true
- https://ab9a1f65-bfbb-41df-a830-83bab4426acd.filesusr.com/ugd/33a16d_7f8860ac89494d358ef4efe5572b3d68.pdf?index=true
- https://3b74e6f0-e841-4984-a5dc-caac1ff2b142.filesusr.com/ugd/9058e5_a10a21681b13460fb879e70dd7a9ff7d.pdf?index=true
- https://a446b65d-45bc-45d3-9b62-7717749cfd33.filesusr.com/ugd/02af14_6945bb4637db4e8090d1ed8d74404e48.pdf?index=true
- https://cdn.shopify.com/s/files/1/0435/6472/8479/files/antoni_goubiew_bolesaw_chrobry.pdf
- https://cdn.shopify.com/s/files/1/0434/5570/9341/files/cardinal_utility_vs_ordinal_utility.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004f8c.bin` `d34cfa9fe2baf70ca857881b2b2580e40155c73fa6a9fe49b2f5dc01e35c76c9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4F8C	5388 bytes
`font_01_sfnt_off000061d6.bin` `b347f113769e04964dce6aca6c36ebcc7f3f6e6b75dd1e3bfd7b26d3391c2437`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61D6	10140 bytes
`font_02_sfnt_off000083b6.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83B6	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.