PDF malware analysis — malicious · 2283e591d694052f

MALICIOUS

PDF

42.4 KB Created: 2020-08-30 17:07:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ac80253cb74b7cde71cb88555c108cd0 SHA-1: e324c91287871e0e5234a7fed755127bb326f7a3 SHA-256: 2283e591d694052f084e5720c8fb5c4be2c1520d7b92c9833e37761d81219a83

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links pointing to external PDF documents, a technique often used for SEO manipulation or to host malicious content. One of the embedded links, 'https://ttraff.com/wix?keyword=analisis+de+flujo+de+procesos+ejemplo', is flagged as a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body itself contains garbled text and a repeated URL, further supporting the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=analisis+de+flujo+de+procesos+ejemplo
- https://static.usrfiles.com/ugd/f8de3e_5e105baf1f5240da930ef90cdb8e4b8e.pdf
- https://static.usrfiles.com/ugd/b8c837_fb535a3769be4c5fbdc1600a9f909bca.pdf
- https://static.usrfiles.com/ugd/b8c837_05c48aadc00045f3a10cb15d4f2c7443.pdf
- https://static.usrfiles.com/ugd/105a8c_aeb25f9478554a64afd153ff93bfafe2.pdf
- https://static.usrfiles.com/ugd/76156b_045183bceaf74cf68dffff3fc6ce4cb6.pdf
- https://cdn.shopify.com/s/files/1/0432/9334/3902/files/hotel_formule_1_bar_sur_aube.pdf
- https://cdn.shopify.com/s/files/1/0434/3611/4076/files/atomic_structure_book.pdf
- https://cdn.shopify.com/s/files/1/0431/7007/0690/files/88635424425.pdf
- https://cdn.shopify.com/s/files/1/0430/8231/7978/files/lugokebutabijelizosepezev.pdf
- https://static.usrfiles.com/ugd/b914b5_90e946e136a14a5790df4055bc660e57.pdf
- https://static.usrfiles.com/ugd/516793_753b2195c53f459297aca8d3d24c19dc.pdf
- https://static.usrfiles.com/ugd/b8c837_47b202d7a54d49bcb8fff20e4828ace3.pdf
- https://static.usrfiles.com/ugd/7041e4_4f6544c2aa824a6485d49b84799ae4fd.pdf
- https://static.usrfiles.com/ugd/b8c837_5941800d48d84f419c6aca8870b62f18.pdf
- https://static.usrfiles.com/ugd/824332_a53618d9d1224553a5b61b04cc9b6a91.pdf
- https://static.usrfiles.com/ugd/b8c837_e35fb9174f764b579e129f622a8f2444.pdf
- https://static.usrfiles.com/ugd/ea9bdf_6a047b2202ce48b089f209669d4a6d72.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006545.bin` `9dc2fb9383538a34960bdb1b84dcef67847c8bf06779e63ed1cd47bd7808172c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6545	5368 bytes
`font_01_sfnt_off0000776b.bin` `d0adcfb516b6938bb7b0004b3aebcba5a8a9faa8740938df9b2b32f9a7b5121d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x776B	10824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.