PDF malware analysis — malicious · 36f025b1b608eb0f

MALICIOUS

PDF

41.3 KB Created: 2020-08-31 17:05:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0119ee781e7b271581d0f74d9050f3d0 SHA-1: 9b5d31a14fc3afd9b6a7dd25bf37d0e88ad05b93 SHA-256: 36f025b1b608eb0f0140263849c2285f88f8a623e5349c3705a56c9f20308819

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified as a link farm. One of these links, 'https://ttraff.cc/pify?keyword=calamari+steak+nutritional+information', points to a known malicious redirector. The document body, though heavily obfuscated, appears to contain text related to 'calamari steak nutritional information' which is likely a lure. The primary attack pattern involves redirecting the user to malicious infrastructure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=calamari+steak+nutritional+information
- https://static.usrfiles.com/ugd/e2c6c1_a6c96a77b83c4a8f92d96d27ad6d45df.pdf
- https://static.usrfiles.com/ugd/b8c837_a7543a49c0ef427ab294ad4b80b9a20b.pdf
- https://static.usrfiles.com/ugd/b8c837_a81dc73f478046abb8e658efe26eccdc.pdf
- https://static.usrfiles.com/ugd/b8c837_eebae45992ab439ba4e4491924dd2d86.pdf
- https://static.usrfiles.com/ugd/73c254_37888014e54547e2b607b925ec39c356.pdf
- https://static.usrfiles.com/ugd/dfb5f8_37588bd028274796aa91b676ed5abb30.pdf
- https://static.usrfiles.com/ugd/e3834b_5e18eabf8c7543869d09df1fbc7bea36.pdf
- https://static.usrfiles.com/ugd/b444d4_ba8db249636c422186068c94950d2f1a.pdf
- https://cdn.shopify.com/s/files/1/0433/7677/1224/files/41478992435.pdf
- https://cdn.shopify.com/s/files/1/0433/7382/2102/files/gunida.pdf
- https://cdn.shopify.com/s/files/1/0430/0419/9075/files/numbers_in_russian.pdf
- https://cdn.shopify.com/s/files/1/0429/1674/1286/files/decimal_fraction_percentage_worksheet.pdf
- https://static.usrfiles.com/ugd/2e4eb4_6f85707cd003498f950740ba43393d39.pdf
- https://static.usrfiles.com/ugd/dd6616_abea81285d3a47bb96c1a977ac2fc33e.pdf
- https://static.usrfiles.com/ugd/756799_19c4e2c08fdc4509a348a87639e9bdda.pdf
- https://static.usrfiles.com/ugd/b8c837_bfa6a90dcf8d4c189bf461da969c0441.pdf
- https://static.usrfiles.com/ugd/55cc32_a94eeb457fb94e13902cc9619ae15c58.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006562.bin` `449cadb5edc75cf9f0340e7d9c5b43624962da35761a2d3e8a47850ad59e68af`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6562	4884 bytes
`font_01_sfnt_off000075e3.bin` `bcc444aa0c3cdec6f00d15f1babdcf4d57786b9171af7a1deeb8057f6bb412e2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75E3	10072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.