PDF malware analysis — malicious · 1b6b31e72c5fda08

MALICIOUS

PDF

41.0 KB Created: 2020-08-31 03:26:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ab29356054bddcbe68330f3e5ea8ee62 SHA-1: f869959fb9f183c4ce260ac885ed55339c53a035 SHA-256: 1b6b31e72c5fda08406c56d638447a3c82d90e4c9b6149ea35b24304422d962e

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious by an ML classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that appears to be part of a link farm, with many external PDF links. The primary malicious IOC is the redirector URL, which likely serves as a gateway to further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=manual+de+geriatria+merck+pdf
- https://static.usrfiles.com/ugd/3b47cb_21ede6ae70624457bad1c2a568f91d88.pdf
- https://static.usrfiles.com/ugd/b8c837_27577276623640c6a825ef9012684114.pdf
- https://static.usrfiles.com/ugd/ae15ca_4029e7b6be68475aa2e834a7768602cc.pdf
- https://static.usrfiles.com/ugd/856cea_43e541681b02434da0374c84a9686863.pdf
- https://static.usrfiles.com/ugd/b8c837_6aae4917859e4932aac2d8b100caaea6.pdf
- https://cdn.shopify.com/s/files/1/0432/3062/5950/files/51127233437.pdf
- https://cdn.shopify.com/s/files/1/0439/5335/6955/files/jorewafolopusaxijalegone.pdf
- https://cdn.shopify.com/s/files/1/0430/1537/2953/files/21534833768.pdf
- https://cdn.shopify.com/s/files/1/0433/5727/4270/files/newesipodetujuzelogige.pdf
- https://cdn.shopify.com/s/files/1/0431/1475/8293/files/gakonijesevipesaj.pdf
- https://static.usrfiles.com/ugd/b8c837_649fc76ab302416196cc732d72362e6c.pdf
- https://static.usrfiles.com/ugd/b8c837_b0da1d4032d04b75bf8ad127122a9d82.pdf
- https://static.usrfiles.com/ugd/eb5a6a_a3171f09bfdd4dd3a709ee130daebda7.pdf
- https://static.usrfiles.com/ugd/b8c837_d7a5154abc534d9fb684c0cba3385b6e.pdf
- https://static.usrfiles.com/ugd/b8c837_9da6157660044a06930c73ded686fa4e.pdf
- https://static.usrfiles.com/ugd/f55bec_e356ad91d4114dee8094a8dcfcf2896a.pdf
- https://static.usrfiles.com/ugd/b8c837_fec1fbf942ba4a808d1d1c814c909eef.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000627d.bin` `d998640cddb7cf30cd72ee39515e8ed43ba78124d0d89e01baceb3fb41fade09`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x627D	5368 bytes
`font_01_sfnt_off000074b1.bin` `466fcc54f3892d4359634e77be1f7b7144d1f720b0e7b82f7f17aec8c93d969b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x74B1	10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.