PDF malware analysis — malicious · 2259795118ab62ec

MALICIOUS

PDF

36.2 KB Created: 2020-09-19 20:51:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9aab1f6b91c841e95333847680b39414 SHA-1: e4cae9fb71329e9c6801c9d66a5d2e3b49cdef5d SHA-256: 2259795118ab62ec1312b31d04399c6290e68f406b54216f12ee3ef6b79eec69

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.club' with a keyword suggesting a game download lure. Additionally, the PDF is flagged as a link farm, containing numerous external links, many of which are hosted on 'filesusr.com'. The ML classifier also strongly indicated maliciousness. The primary attack vector appears to be social engineering via a deceptive link within the document body.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=dungeon+hunter+3+apkpure
- http://files.tagis.pt/uploads/1/3/1/1/131164122/4731765.pdf
- http://jodutevi.scottishceremonies.com/uploads/1/3/1/3/131379174/sebuxosuronid.pdf
- http://peketete.joyfulartstudio.org/uploads/1/3/1/8/131857315/7673110ff18066.pdf
- http://files.garyscocktailmuddlers.com/uploads/1/3/0/7/130739542/xapexubuvevu_mewax_wemis.pdf
- http://files.thedigestible.com/uploads/1/3/0/7/130739731/77cb773.pdf
- http://dosokaju.maplegroveumciowa.com/uploads/1/3/1/3/131384021/25e9ea6a.pdf
- https://93d375e9-8f28-4245-b4c5-534093133c05.filesusr.com/ugd/a91264_45e0938a852146c4abf9115b88a27b59.pdf?index=true
- https://27fa975d-861c-496f-8f63-3556b01e8790.filesusr.com/ugd/3615fb_e7536236baf648df89e8b396f37c5a0c.pdf?index=true
- https://c2b437e2-a940-4c49-95ea-18b07dc4badd.filesusr.com/ugd/a31856_4685c4c74bf0414dbf0ce627f966096c.pdf?index=true
- https://a01039c8-fa4a-40eb-a732-e2db6ec46220.filesusr.com/ugd/96564c_c648bef43c65424bb0311029533f7393.pdf?index=true
- https://63b7931e-98d7-4d2a-92da-1d55c6475a3a.filesusr.com/ugd/1813b3_f563f833bfb1425c8217e782f3a09aa1.pdf?index=true
- https://1806ae17-3940-4477-98fb-6adee35b341d.filesusr.com/ugd/3f0e57_0b934cd0ea5447f590296d7ef906e2f1.pdf?index=true
- https://465d0bf6-6b47-4660-a13c-f9861063efe1.filesusr.com/ugd/575fb0_ecb8d66da4164435a0579927c614557d.pdf?index=true
- https://d775e9ef-d947-4c1d-84d6-300afea22de9.filesusr.com/ugd/3aca14_00581744b7774c6c8fa01a2160206e01.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000505c.bin` `35ab0938b5fd78dd5702d0fffe8a5128412887aaf424752aaa0d65811ac3c9d7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x505C	5096 bytes
`font_01_sfnt_off000061bb.bin` `9bbb4ef03099e1ebf111a85b86bcd82f885dff332635777c7d8290c7e9c173d2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61BB	10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.