PDF malware analysis — malicious · 2fda043582690a52

MALICIOUS

PDF

40.2 KB Created: 2020-08-31 11:59:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: af049bcca2fd2daf5fec30376461a05b SHA-1: c5487fb2e0dfe08bc70287810e469e04e5b31924 SHA-256: 2fda043582690a523723c15a3ae21ad0c160fe38386293b57d4f2398e5778c4a

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged as malicious by an ML classifier and contains a high number of embedded links, including one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the URL https://ttraff.cc/wix?keyword=command+workstation+mac, which is a critical finding. The presence of a link farm suggests an attempt to distribute malicious content or phish users.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=command+workstation+mac
- https://static.usrfiles.com/ugd/ce0e6d_f9e925832c564fdd9799ace249efef5e.pdf
- https://static.usrfiles.com/ugd/a01749_bf37e6f3bb8e48f3a05e3783c975c5b6.pdf
- https://static.usrfiles.com/ugd/9c43ec_b029cf873850492b9d6f3dd7bfd4c51d.pdf
- https://cdn.shopify.com/s/files/1/0431/7157/8007/files/tamil_baby_boy_names_hindu.pdf
- https://cdn.shopify.com/s/files/1/0434/1645/3272/files/41194653565.pdf
- https://cdn.shopify.com/s/files/1/0432/2433/4498/files/punukezajevewoxerurafibow.pdf
- https://cdn.shopify.com/s/files/1/0434/7786/0516/files/zozulusetodinegoxev.pdf
- https://static.usrfiles.com/ugd/429b25_482a183b2829491aa134c42619d5831d.pdf
- https://static.usrfiles.com/ugd/804ff6_b97075aee7594b469cc72e23b058ccbe.pdf
- https://static.usrfiles.com/ugd/33c377_118ae96b5b574ce4b3e10a9edabe1901.pdf
- https://cdn.shopify.com/s/files/1/0435/9654/6216/files/apush_chapter_13_review_packet_answers.pdf
- https://cdn.shopify.com/s/files/1/0431/3668/0098/files/measuring_up_reading_level_h_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0432/8338/2427/files/tuwipafabijunamatuz.pdf
- https://cdn.shopify.com/s/files/1/0428/2158/3004/files/honda_gcv160_pressure_washer_manual.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005297.bin` `119589f1d7a988bde41d4b45c3a216d9e5807e1b32c4806ee915d6cadd9c7647`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5297	4900 bytes
`font_01_sfnt_off0000632d.bin` `3dd90ce44985ed03bbf87aea232a9edb07163ed8aed777c3108596de5c766ede`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x632D	10396 bytes
`font_02_sfnt_off0000863c.bin` `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x863C	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.