PDF malware analysis — malicious · fbaa4958f8b7dbeb

MALICIOUS

PDF

36.8 KB Created: 2020-08-30 12:20:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 49d4e7c179934235d9bef5a0c945994a SHA-1: ed0272df7eb5f749404fa3c8b2453c4a93e3ae6a SHA-256: fbaa4958f8b7dbeb5a155b42c3979fbd3568947542f87c44976dba21a920321e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a link to a known malicious redirector, ttraff.ru, which is disguised with a keyword related to 'Pokemon'. The document body also contains this keyword and a link to the redirector, suggesting a social engineering lure. The PDF also hosts a large number of external PDF links, many pointing to static.usrfiles.com, indicating a link farm used for SEO poisoning or to distribute further malicious content. No scripts were extracted, but the primary attack vector appears to be a malicious redirector link embedded within the document.

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=pokemon+season+17+episode+13+in+hindi
- https://static.usrfiles.com/ugd/d7ba0f_c8b17240ec9547718af2fe483434de8f.pdf
- https://static.usrfiles.com/ugd/f80014_9883d09afd354850a6f59920bd82ca52.pdf
- https://static.usrfiles.com/ugd/e2c6c1_b68c6eef979d45de84048b32b925ef51.pdf
- https://static.usrfiles.com/ugd/b8c837_312ad0571ab1466f833c3adc3bb07fe7.pdf
- https://cdn.shopify.com/s/files/1/0459/1216/2453/files/node_red_mustache_template_example.pdf
- https://cdn.shopify.com/s/files/1/0437/9718/4673/files/palisosonafalomutopaguso.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nemevisofopanufu.pdf
- https://static.usrfiles.com/ugd/217d68_3112e8bd7cd24b11a711ce972dddfdc7.pdf
- https://static.usrfiles.com/ugd/b8c837_1bedf9e09c29401ab5e7aa4503b9ba88.pdf
- https://static.usrfiles.com/ugd/10e3af_0cfa53660b0640a49f874a72ae2b2fe7.pdf
- https://static.usrfiles.com/ugd/b8c837_eb823b2bf3bf42fab79ae2377cbac88d.pdf
- https://static.usrfiles.com/ugd/b8c837_d7db216997f74cfd80574b7e4d3ad207.pdf
- https://static.usrfiles.com/ugd/78c764_a3e22068e6744e24a3eaa81432b8d95e.pdf
- https://static.usrfiles.com/ugd/1f2646_9ac24fd5f9d3453fb904e8d7efae7515.pdf
- https://static.usrfiles.com/ugd/2f8cea_8306c006f3f74f1a98f3e01c8198154d.pdf
- https://static.usrfiles.com/ugd/6846fe_23deb11122fa416382a3f30b7b35d29f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005128.bin` `359c8e0a6106ffba37fd77bb951d77400e30f31ea0a56af49aee6d194ad7c82d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5128	5432 bytes
`font_01_sfnt_off0000638d.bin` `66dc072da1bad4fa66039e540c839837f409a13a27b30e6e398e2febbec08e0c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x638D	10204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.