PDF malware analysis — malicious · 1af548d84ceea7f9

MALICIOUS

PDF

52.5 KB Created: 2020-08-29 12:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c427b16d4893928284732a4042980416 SHA-1: baa31ed22c331fb8363396d53cf79aa0d49fa166 SHA-256: 1af548d84ceea7f9edcb2bbc31efa41a89a6c6fb69ff29c12a6af5b1b5eafe44

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a link farm. The primary malicious URL identified is https://ttraff.com/wix?keyword=cl2o+bond+angle, which is likely used to direct users to a malicious site. The document body contains garbled text and embedded URLs, further supporting the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=cl2o+bond+angle
- https://static.usrfiles.com/ugd/b8c837_ad7a99210a994cf8b5527a8b86da81c2.pdf
- https://static.usrfiles.com/ugd/b8c837_f9094cecce29413e8dbf969416a669a0.pdf
- https://static.usrfiles.com/ugd/b8c837_9e1c665a6c0f4ef59084568526fe18b9.pdf
- https://static.usrfiles.com/ugd/b8c837_2fb266e499a54490bb06de81e88ea0c1.pdf
- https://static.usrfiles.com/ugd/b8c837_660a542f2a6240eca9ad1025ebc1719f.pdf
- https://static.usrfiles.com/ugd/b8c837_ee60ffe794b9420398a5a1d2f0fbddd4.pdf
- https://static.usrfiles.com/ugd/b8c837_435fc61ce0cf48f4baf93d65ab1f9093.pdf
- https://static.usrfiles.com/ugd/66c878_61addb6417bc4dffbb659e30823c70f9.pdf
- https://static.usrfiles.com/ugd/b8c837_903b726c902b488586ce359cbef7db61.pdf
- https://static.usrfiles.com/ugd/b8c837_958296bf50a54ab59f4d998d3d98c7f3.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/kesutuzijakakewinepubad.pdf
- https://cdn.shopify.com/s/files/1/0431/5014/7733/files/grade_12_mathematics_platinum_textbook_download.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/31906594002.pdf
- https://cdn.shopify.com/s/files/1/0435/5912/5160/files/barcelona_team_players_formation.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006801.bin` `b9c1bd2281f23f09d905494077011cda678d8ff8a20e62f41a46584ce81a564d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6801	6492 bytes
`font_01_sfnt_off00007836.bin` `a05aaf5074fcc5b50c5edf5361b5795503ed6e27833086c7c4f3e308f2e43e57`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7836	4896 bytes
`font_02_sfnt_off000088e7.bin` `c31b9d49049c141bdaa88cd978843a3bec249b9b83fc425ed1a84ccc06f05f41`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88E7	11528 bytes
`font_03_sfnt_off0000af80.bin` `dfdc6983d3c42b81f9741fa6cdceaab3e97c1fbda00e6274acf933e6ff911e94`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAF80	16100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.