PDF malware analysis — malicious · 1aa26a65d9b3c9f6

MALICIOUS

PDF

46.1 KB Created: 2020-09-01 05:20:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b74e651287209b6fe1932643005bd109 SHA-1: 7ac35cdf3a30db4bd710261088ccc691375e9dc3 SHA-256: 1aa26a65d9b3c9f6d96dec37eaebbd6e9bddc08b5e188a41710a27191bc6afc8

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, with many pointing to a redirector service (ttraff.link). This technique is often used to obscure the true destination of malicious content. The ML classifier strongly indicated maliciousness, and the presence of a link farm further supports a malicious intent, likely for SEO poisoning or driving traffic to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/pify?keyword=bahubali+3+ka+gana
- https://cdn.shopify.com/s/files/1/0431/3861/3415/files/86171795964.pdf
- https://cdn.shopify.com/s/files/1/0427/5752/1574/files/memeb.pdf
- https://cdn.shopify.com/s/files/1/0439/2986/2312/files/toruw.pdf
- https://cdn.shopify.com/s/files/1/0427/9359/9132/files/31750725286.pdf
- https://cdn.shopify.com/s/files/1/0431/6810/4610/files/17744846791.pdf
- https://static.usrfiles.com/ugd/b8c837_68ddddd5a1754db5928c765591c206e2.pdf
- https://static.usrfiles.com/ugd/d5415a_4349e4031af34468b59e5d4f8f1b78b8.pdf
- https://static.usrfiles.com/ugd/4f270c_33c16a471b23441ab1d3a43c45a7363c.pdf
- https://static.usrfiles.com/ugd/b8c837_941a267a2d6b460f93fc17b5f551428b.pdf
- https://static.usrfiles.com/ugd/9ff9b8_d759f21356b648228a9804a874134d73.pdf
- https://static.usrfiles.com/ugd/41a0b6_b04ef9bd0dab444abcd41b7fea13d490.pdf
- https://static.usrfiles.com/ugd/45e30f_6c325c8793ad4b479e908f3b0a7c84cb.pdf
- https://static.usrfiles.com/ugd/e5a943_98d0e799ca2a4632ba45f72f249a1e67.pdf
- https://static.usrfiles.com/ugd/b8c837_c9b8e2d6641343489e16d1e6645c7033.pdf
- https://static.usrfiles.com/ugd/913720_8a5d65e91d9f40e0834ef1c665a45cc5.pdf
- https://static.usrfiles.com/ugd/4dd980_095f2d1bfbd34195ad8c1219a88d3359.pdf
- https://static.usrfiles.com/ugd/c1108c_568aa5586a01460e8d93617ddeaf76bd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/c1108c_568aa55

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a65.bin` `8a85fd538b65783fa1cdd643f86bb5e9dbaaf6fd7e4670870f179b1d41b06769`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A65	5088 bytes
`font_01_sfnt_off00007bb8.bin` `814a8259e4652c33cd1d9c2132a22ff09870922d792ccc77d1edfa6841d25014`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BB8	16024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.