PDF malware analysis — malicious · 3323ecef52e596ad

MALICIOUS

PDF

39.2 KB Created: 2020-09-05 22:07:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0317383de8f38579bf0daaa2d120f9db SHA-1: 168ecf1a5f966b12b9f00b0c788c1eb88824e07c SHA-256: 3323ecef52e596ade292e4c710a19d48212a3e503da8c68425c71bf9225b0cb7

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.ru/pify?keyword=madras+high+court+case+status+report'. This URL is embedded within the document body, suggesting a social engineering attempt to trick the user into visiting a malicious site. The presence of a large number of external PDF links, many pointing to Shopify domains, further indicates a link farm or SEO poisoning tactic to obscure the malicious intent. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=madras+high+court+case+status+report
- https://static.usrfiles.com/ugd/011e4b_3fd2b787e5244dc9aa5f0f3247ec3401.pdf
- https://static.usrfiles.com/ugd/b8c837_823f16bd4e6a43ed96410974cb865342.pdf
- https://static.usrfiles.com/ugd/963627_070042e3bf404f9c9bae3bf1334aea97.pdf
- https://static.usrfiles.com/ugd/b8c837_3ba1575a95e042ae8e625d3dd533067c.pdf
- https://cdn.shopify.com/s/files/1/0459/8982/2631/files/list_of_offline_adventure_games_for_android.pdf
- https://cdn.shopify.com/s/files/1/0430/4915/6757/files/active_fishing_guide_bdo.pdf
- https://cdn.shopify.com/s/files/1/0459/2553/1815/files/iphone_xs_background_template.pdf
- https://cdn.shopify.com/s/files/1/0437/7106/8577/files/11642669728.pdf
- https://cdn.shopify.com/s/files/1/0437/1139/8042/files/luremopizopaza.pdf
- https://cdn.shopify.com/s/files/1/0435/4008/6935/files/m5r1_service_manual.pdf
- https://cdn.shopify.com/s/files/1/0428/5438/3782/files/69008821492.pdf
- https://cdn.shopify.com/s/files/1/0439/3218/8840/files/canyon_burger_menu.pdf
- https://cdn.shopify.com/s/files/1/0429/7395/4204/files/nunejamowuxorikibukulopo.pdf
- https://static.usrfiles.com/ugd/93971e_7d5858ebc3b24a1aa5450e19c6c50575.pdf
- https://static.usrfiles.com/ugd/3cb679_0d5d6ae43a09463e841dd7404bce5508.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005c5c.bin` `baca9fb571a074a3944622ce676bdb5ad2dc1a460931d30ae6e74c172d360ff1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C5C	5308 bytes
`font_01_sfnt_off00006e71.bin` `fed11146669b1fdb3fef9ee0ca90188634fe3659eeea405638688db4f64417cc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E71	9844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.