PDF malware analysis — malicious · 30651afa823a3295

MALICIOUS

PDF

60.4 KB Created: 2020-08-24 21:18:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9f9a89d744f0cf583e2e4b24d322b46b SHA-1: d01050a856dcee572e186e36c0eb950f91c03bba SHA-256: 30651afa823a3295754bc3b398bf8d07b59c8ce74b10e826d05fe7421bf90112

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, many of which point to a link farm designed for SEO manipulation. One prominent link directs to a known malicious redirector, 'ttraff.ru', which is likely intended to lead the user to a malicious payload. The ML classifier strongly indicated maliciousness, and the PDF structure itself is indicative of a malicious document.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=cardigan+welsh+corgi+breed+information
- http://tisozobe.doublephorsemanship.com/uploads/1/3/1/6/131637839/38e0b429959dd.pdf
- http://files.stockela.com/uploads/1/3/2/6/132681863/sajotudozoga_rakazik_jivukivefu_fiwakekezib.pdf
- http://files.cmanva.com/uploads/1/3/1/3/131378950/sodip.pdf
- http://bomivu.nhsmanufacturing.com/uploads/1/3/0/7/130738962/sawefefotadan.pdf
- http://mopilurap.westvirginiaballroom.com/uploads/1/3/1/4/131437753/1129955.pdf
- https://cdn.shopify.com/s/files/1/0432/5395/6758/files/97235698976.pdf
- https://cdn.shopify.com/s/files/1/0435/5378/3957/files/59927426851.pdf
- https://cdn.shopify.com/s/files/1/0431/1724/8672/files/48058645815.pdf
- https://cdn.shopify.com/s/files/1/0435/4303/6053/files/dajalepupekir.pdf
- https://cdn.shopify.com/s/files/1/0428/5107/4214/files/68425809712.pdf
- https://cdn.shopify.com/s/files/1/0434/1504/4252/files/64690261689.pdf
- https://cdn.shopify.com/s/files/1/0436/8157/9161/files/vupaxosedosuvogiganobuxab.pdf
- https://cdn.shopify.com/s/files/1/0434/6255/7856/files/35236324509.pdf
- https://cdn.shopify.com/s/files/1/0427/8901/1612/files/15494720211.pdf
- https://cdn.shopify.com/s/files/1/0434/4214/3389/files/anti_allergy_bed_sheets.pdf
- https://cdn.shopify.com/s/files/1/0428/5267/9836/files/explain_the_agents_of_socialization.pdf
- https://cdn.shopify.com/s/files/1/0434/3631/0693/files/1997_seadoo_bombardier_speedster.pdf
- https://cdn.shopify.com/s/files/1/0453/2790/9019/files/35664838096.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ae5c.bin` `8e1d2fd3c350c5d5e933c97abc46aba0bb9aad766fde97655bf7e408e67916b8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAE5C	5572 bytes
`font_01_sfnt_off0000c139.bin` `9160b852d92588b68a9e1d80c8a85b04cf44b8134b818c7ca76805d0f3258765`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC139	10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.