PDF malware analysis — malicious · 20142709a2d16617

MALICIOUS

PDF

45.5 KB Created: 2020-08-19 03:36:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c151e2ca33b5c2e9c1575c7dcb1a6ca1 SHA-1: c7df3b058fad77ebd1eb3ee1f520b5eaef9f3d9d SHA-256: 20142709a2d16617673cbe61ea9371c797eb3f82a831d39d183c8d9bbfa13b08

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This URL is presented to the user as 'Bsc english notes sargodha university pdf', indicating a social engineering lure. The document also contains a large number of embedded links, many of which point to Shopify domains, but the primary malicious indicator is the ttraff.com redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=bsc+english+notes+sargodha+university+pdf
- http://files.sasquatchthrows.com/uploads/1/3/0/8/130813526/9069681.pdf
- http://files.waxjewelrydesignstudio.com/uploads/1/3/1/8/131856435/8426657.pdf
- https://cdn.shopify.com/s/files/1/0430/5174/5442/files/95368770959.pdf
- https://cdn.shopify.com/s/files/1/0432/5575/9006/files/55051431732.pdf
- https://cdn.shopify.com/s/files/1/0433/5271/9515/files/72143932041.pdf
- https://cdn.shopify.com/s/files/1/0433/9869/3022/files/jiped.pdf
- https://cdn.shopify.com/s/files/1/0434/3929/2582/files/agenda_for_board_meeting.pdf
- https://cdn.shopify.com/s/files/1/0433/7133/1734/files/dukipodudo.pdf
- https://cdn.shopify.com/s/files/1/0439/4975/2478/files/ravozupurofe.pdf
- https://cdn.shopify.com/s/files/1/0430/4375/0039/files/evaporation_and_evapotranspiration.pdf
- https://cdn.shopify.com/s/files/1/0433/1290/6405/files/86671610857.pdf
- https://cdn.shopify.com/s/files/1/0438/5269/3654/files/besagavajuxozujotijuka.pdf
- https://cdn.shopify.com/s/files/1/0430/5649/6791/files/subimaviji.pdf
- https://cdn.shopify.com/s/files/1/0434/1563/4071/files/luniwanunopugij.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000552a.bin` `9a60bbbbbf740e8b082397d7134e9347d35e0968be852b6dce7446027ee07aa5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x552A	5508 bytes
`font_01_sfnt_off000067d7.bin` `7a02da73c5ff24218d04b188db7d31ceb9303d5dedd43b645f18a615a19d9b6a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x67D7	6068 bytes
`font_02_sfnt_off00007788.bin` `ca91c5efa734f531ca27ecc0bb99ff57a40ca355d5508e496fbab21ff24dd1e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7788	10304 bytes
`font_03_sfnt_off00009a91.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9A91	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.