PDF malware analysis — malicious · 1db770c69465f9f6

MALICIOUS

PDF

42.0 KB Created: 2020-09-04 03:43:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b5ffd06fe7f4c406a50d7040e742b44a SHA-1: b95adcbf6ad04cf11d009e17a4a2247cf2d54dcc SHA-256: 1db770c69465f9f63beb52b2822788b148739fb9962d3cfc2651602b6632367f

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. The document body, though heavily obfuscated, contains text related to a 'guide visite plage debarquement normandie' and the malicious URL itself. This suggests a social engineering lure to drive traffic to the redirector, which is likely used for subsequent phishing or malware delivery. The presence of a large number of external PDF links also indicates a link farm, potentially for SEO manipulation or to obscure the true malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=guide+visite+plage+debarquement+normandie
- https://cdn.shopify.com/s/files/1/0431/0279/7986/files/97392926671.pdf
- https://cdn.shopify.com/s/files/1/0428/6555/7671/files/frankfurt_airport_layout.pdf
- https://cdn.shopify.com/s/files/1/0437/6929/9098/files/tamilrockers._com_full_movie_tamil.pdf
- https://cdn.shopify.com/s/files/1/0429/2752/1948/files/fukukuxuromoder.pdf
- https://cdn.shopify.com/s/files/1/0460/8743/8500/files/dell_r720_bios_update.pdf
- https://static.usrfiles.com/ugd/b8c837_fdc282079e82424ca25f13a1dc5378d9.pdf
- https://static.usrfiles.com/ugd/f1780b_502f2d82fe1b4c16a31438935f47c2cd.pdf
- https://static.usrfiles.com/ugd/d162e3_da255ac2dd6d4291987d9153304a4acb.pdf
- https://static.usrfiles.com/ugd/b8c837_51b0f10196fc49fb995db2fd324f2de6.pdf
- https://static.usrfiles.com/ugd/0cd3a8_888f8e2d27a44aab8604369ec1fa4d11.pdf
- https://static.usrfiles.com/ugd/078c79_afa5225cb502426f99908bdba05f85b0.pdf
- https://static.usrfiles.com/ugd/50de67_2114f73536f748989d22a66ce62c7664.pdf
- https://cdn.shopify.com/s/files/1/0432/0142/9662/files/jifatij.pdf
- https://cdn.shopify.com/s/files/1/0433/4937/7174/files/free_java_books_for_beginners.pdf
- https://cdn.shopify.com/s/files/1/0432/5723/3576/files/87504085336.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006120.bin` `59196b90dadce96be4a82b118359986fbd20a669bde0b8dd16df2405446bae1c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6120	5636 bytes
`font_01_sfnt_off0000742f.bin` `9b56019a991e8217b9208101ab997b1f6741d6743e7158f6d772b86bac39ad98`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x742F	11744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.