PDF malware analysis — malicious · 2567664a45c21420

MALICIOUS

PDF

41.5 KB Created: 2020-09-01 03:06:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ecc6c5933135f0e437ef717c13900941 SHA-1: 666325d4b0986cb34f215e508effd6130a60d94a SHA-256: 2567664a45c21420d292dd9b662df18a264c0e7376e434757005bcb88d130ec6

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'ttraff.ru'. The document body, though heavily obfuscated, contains the same URL and text related to a 'debt service coverage ratio calculation template', suggesting a lure. The presence of a large number of external PDF links, many hosted on 'static.usrfiles.com', indicates a link farm strategy, likely to improve SEO for malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=debt+service+coverage+ratio+calculation+template
- https://static.usrfiles.com/ugd/ac51ce_16d32c114910471881c7e36e1541809d.pdf
- https://static.usrfiles.com/ugd/9ec29b_34b721df36494a13ab4901f685195cfb.pdf
- https://static.usrfiles.com/ugd/de65f7_81f54555dba74921b20923af497e0488.pdf
- https://cdn.shopify.com/s/files/1/0432/3924/3943/files/nemejapumisuremumit.pdf
- https://static.usrfiles.com/ugd/71fd01_825e8fe03d15486d86dfb47e764eafc5.pdf
- https://static.usrfiles.com/ugd/d9d1f5_d824c433dee74661a09bfc8308997357.pdf
- https://static.usrfiles.com/ugd/cb2bed_af7b3153dcd7442f94d12bb598be4a46.pdf
- https://static.usrfiles.com/ugd/1f2646_4a3ebdd8f8bb49de8753e6f05c0808bf.pdf
- https://static.usrfiles.com/ugd/e5a943_bdca81e81fc24fc0bf5201ad8eec87f4.pdf
- https://static.usrfiles.com/ugd/6260fe_5cf226fdcb634142909035cef972e150.pdf
- https://static.usrfiles.com/ugd/d55797_23e1d991b60d48f68fef842880c9e74e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006383.bin` `1f16f951217e9040898fa363a77e15d128bab28188227df98ea5e285a3ba95d5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6383	5452 bytes
`font_01_sfnt_off00007609.bin` `bc7449bf87f2d26e49b914cd9afcb6feef27ee2ea10fff900578808cb2e13675`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7609	10364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.