PDF malware analysis — malicious · 3018c59348ea0d99

MALICIOUS

PDF

45.8 KB Created: 2020-07-31 04:28:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0743207d681a7531953e8a871578291f SHA-1: c290c6902875b8b4049adc4ecfdccc7d0246a1d2 SHA-256: 3018c59348ea0d993d8fa7f599ffe7830c6711ed84ba299aac71a68e999eafeb

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing indicating a link to known malicious redirector infrastructure. The document body, though partially corrupted, suggests a lure related to vehicle transfer forms. The primary malicious IOC is the ttraff.com URL, which is likely used to redirect the user to a phishing or malware distribution site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=formulaire+declaration+de+cession+vehicule+pdf
- http://files.thinkinenglish.org/uploads/1/3/1/4/131406811/kifivegipifalas-sesanefafu.pdf
- http://files.newleafclubhouse.com/uploads/1/3/1/3/131378779/gujasulexavavax-naviketuwi-lafamo-gomasib.pdf
- http://files.edgarallanpollo.com/uploads/1/3/1/4/131483361/8894274.pdf
- http://files.newleafclubhouse.com/uploads/1/3/1/3/131378779/gujasulexavavax-naviket
- https://cdn.shopify.com/s/files/1/0429/5104/9370/files/93491442843.pdf
- https://cdn.shopify.com/s/files/1/0432/8708/5220/files/lidaxakefepilewujiki.pdf
- https://cdn.shopify.com/s/files/1/0437/8702/6581/files/zowufiwipebidavugitema.pdf
- https://cdn.shopify.com/s/files/1/0430/2805/4169/files/wujafoxovosivosiguzipojum.pdf
- https://cdn.shopify.com/s/files/1/0435/5378/3957/files/melasezadafe.pdf
- https://cdn.shopify.com/s/files/1/0431/5162/2306/files/demubeseduxawaxupara.pdf
- https://cdn.shopify.com/s/files/1/0430/8674/1655/files/gasujurujokibozelufenox.pdf
- https://cdn.shopify.com/s/files/1/0432/5546/4104/files/79663794281.pdf
- https://cdn.shopify.com/s/files/1/0428/0126/6851/files/37318483912.pdf
- https://cdn.shopify.com/s/files/1/0432/5467/7662/files/zenunoniwofopexuzujaro.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/81988232477.pdf
- https://cdn.shopify.com/s/files/1/0427/5778/3718/files/61480189610.pdf
- https://cdn.shopify.com/s/files/1/0432/6513/0658/files/detifilufulekiduvig.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007206.bin` `d46c034e4fe5c8d2e91e7b3b4e1cb23458b5b1df328d58a1c7ca537990b2a159`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7206	5292 bytes
`font_01_sfnt_off000083d8.bin` `7f05d373c5c47252da720e5d7625bf403e56a9fc479b534df497ed72fa85b137`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83D8	11576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.