PDF malware analysis — malicious · 1c43a16559efad4d

MALICIOUS

PDF

45.7 KB Created: 2020-08-04 01:04:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b50d43a438303566b302f939febbf6fd SHA-1: 273ac9be9d93580b6e1906f01f777fa7417bb1b7 SHA-256: 1c43a16559efad4d99aaf41c1812eeb6cc5f5353619c32456f22a808d63b5da7

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to a link farm hosted on cdn.shopify.com, and one critical link redirects to a known malicious domain (ttraff.com). The document body, though malformed, contains text related to trivia questions, suggesting a lure to encourage clicking the malicious link. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=african+american+history+trivia+questions+and+answers+pdf
- http://files.carolineuahn.com/uploads/1/3/1/4/131452935/merolavos.pdf
- http://files.stcatherineofsienacatholicpv.com/uploads/1/3/0/7/130738875/4f169d.pdf
- http://files.bigcountrydoula.com/uploads/1/3/0/9/130968984/nefatet_rosajojogel_xomerisuriv_sipejatali.pdf
- http://files.zippiteeshirts.com/uploads/1/3/1/3/131380953/4088837.pdf
- http://files.staylorhedgesart.com/uploads/1/3/0/7/130739214/5aac84.pdf
- https://cdn.shopify.com/s/files/1/0431/3173/2122/files/wofumegakomolodorixeke.pdf
- https://cdn.shopify.com/s/files/1/0435/8150/5695/files/approximation_for_ibps_po.pdf
- https://cdn.shopify.com/s/files/1/0428/3754/1031/files/43632344661.pdf
- https://cdn.shopify.com/s/files/1/0431/8111/3506/files/discrete_mathematics_8th_edition_richard_johnsonbaugh.pdf
- https://cdn.shopify.com/s/files/1/0430/6694/9786/files/bejufawilobipamu.pdf
- https://cdn.shopify.com/s/files/1/0431/9356/5342/files/85998950911.pdf
- https://cdn.shopify.com/s/files/1/0429/0940/1251/files/91348980841.pdf
- https://cdn.shopify.com/s/files/1/0441/0540/0472/files/73351518288.pdf
- https://cdn.shopify.com/s/files/1/0429/2512/9894/files/suwekudetanunupo.pdf
- https://cdn.shopify.com/s/files/1/0429/6992/3740/files/marxist_approach_to_industrial_relations.pdf
- https://cdn.shopify.com/s/files/1/0430/6026/5117/files/48497769072.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000738c.bin` `2595fb756b65a676220c087388c387aa48976f15e7226782d207de21e37ab200`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x738C	5732 bytes
`font_01_sfnt_off00008705.bin` `822d12ef48f64bd876e79362a0e2f3a1fb15d7afda9fc1c776b8eaa53ba095db`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8705	10088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.