PDF malware analysis — malicious · 34adf21f5a2f62eb

MALICIOUS

PDF

42.5 KB Created: 2020-08-31 10:30:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 043441460bcdd2966a824291b94edcbe SHA-1: f250a955c4339476d48d8e8e528b992c5a0cc62d SHA-256: 34adf21f5a2f62eb70958d0d2e4ad0968042033a34eea09548e54b30bd8599e1

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link pointing to 'ttraff.com'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs, many hosted on 'static.usrfiles.com'. The document body, though partially corrupted, contains the same URL found in the redirector heuristic, suggesting a deliberate attempt to direct users to potentially harmful content. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=eastern+culture+vs+western+culture+p
- https://static.usrfiles.com/ugd/a474dd_7fc73b8cfec04177b31784e372ec3cf2.pdf
- https://static.usrfiles.com/ugd/87fdc7_0497a6d3abfb4f17a5b2753d3f98835c.pdf
- https://static.usrfiles.com/ugd/c7ef1a_3541425e35ed46a58afaddb8cbc437ff.pdf
- https://static.usrfiles.com/ugd/b5472a_1eacf8ecb13e46f19a200706e95cfcbb.pdf
- https://static.usrfiles.com/ugd/34ec99_eee6d24f3fed418a921866167e757948.pdf
- https://static.usrfiles.com/ugd/26481d_7029820fd1c94bcab54e271c1657711f.pdf
- https://static.usrfiles.com/ugd/b8c837_6af8fe385d894162a2a89e7976411d9d.pdf
- https://cdn.shopify.com/s/files/1/0434/0151/1064/files/centralized_definition.pdf
- https://cdn.shopify.com/s/files/1/0435/2756/9576/files/81053365532.pdf
- https://static.usrfiles.com/ugd/3bca44_197ee05b9bba496196f486fe8c3c02b6.pdf
- https://static.usrfiles.com/ugd/7ea8bb_622aa387ab1d4216b725a2dd6c45a6fc.pdf
- https://static.usrfiles.com/ugd/f0e51d_6ab715f858414d13994fca9736d32687.pdf
- https://static.usrfiles.com/ugd/9e14ca_93ce91fafbdd463d9b38b057c5630bee.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005dea.bin` `4d09623a862c159cd37c52c7953794c8fe787ecc6505b3dd92b76e94c9da3490`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5DEA	4760 bytes
`font_01_sfnt_off00006e2d.bin` `4c37a1d1244c327f412450db66406002e3918c8b42b518bf8cc51d81cd19ac19`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E2D	9612 bytes
`font_02_sfnt_off00008f0a.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F0A	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.