PDF malware analysis — malicious · 275f0810bf01fd80

MALICIOUS

PDF

66.0 KB Created: 2020-08-03 09:58:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ad984aeb4fc20fa0de733f754623384c SHA-1: cc9e259e5bfc151296a32d0f6ba5bce844bbc18d SHA-256: 275f0810bf01fd8044d45b6155fa6784047f073a84f38a991cbe484dc863a3ce

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The ML classifier also strongly indicated maliciousness. The primary malicious URL identified is https://ttraff.com/pify?keyword=david+brooks+and+mark+shields, which is likely used to redirect users to a malicious site. The document body contains obfuscated text and numerous URLs, supporting the link farm heuristic.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=david+brooks+and+mark+shields
- http://files.sharonstephenson.co.nz/uploads/1/3/1/3/131398322/1371681.pdf
- http://files.arcticaircaribbean.com/uploads/1/3/1/8/131856949/409a1d09d3d52b.pdf
- http://files.middleagemiracles.com/uploads/1/3/1/4/131455543/sijalix-jilekisebafo-potibepe.pdf
- http://files.nickhiggs.com/uploads/1/3/2/8/132814967/4758618.pdf
- https://cdn.shopify.com/s/files/1/0430/7720/6165/files/frigidaire_affinity_washer_repair_manual.pdf
- https://cdn.shopify.com/s/files/1/0428/8125/3535/files/zutupila.pdf
- https://cdn.shopify.com/s/files/1/0430/9486/8122/files/gedovujekovuxakawa.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/84312174386.pdf
- https://cdn.shopify.com/s/files/1/0435/1619/9066/files/19609568699.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/jatebilebasa.pdf
- https://cdn.shopify.com/s/files/1/0431/7754/1787/files/dagapiluwiji.pdf
- https://cdn.shopify.com/s/files/1/0441/2178/4472/files/arduino_string_to_int.pdf
- https://cdn.shopify.com/s/files/1/0432/0686/9147/files/jofopibuvaza.pdf
- https://cdn.shopify.com/s/files/1/0435/4444/5092/files/52940867063.pdf
- https://cdn.shopify.com/s/files/1/0431/6885/8280/files/41102904813.pdf
- https://cdn.shopify.com/s/files/1/0433/6903/7974/files/kulanadojumuvuzavobegun.pdf
- https://cdn.shopify.com/s/files/1/0430/7173/3917/files/36163605095.pdf
- https://cdn.shopify.com/s/files/1/0431/8691/3437/files/vidututojejejexajodizaw.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bc0b.bin` `f55121c28845bb5551a1097087e4a37e8d3fa53cd9f97811eaed09fc5ab67395`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC0B	5328 bytes
`font_01_sfnt_off0000ce0a.bin` `dc4d7305f95efe670e675acb2a08c88e84770b1d08ca4b4ee3d63d7bdca84286`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCE0A	14324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.