PDF malware analysis — malicious · 3825e95e495a031b

MALICIOUS

PDF

40.1 KB Created: 2020-09-03 19:41:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 016e9105557a7382b14f7a5cdccce90e SHA-1: 1b6fa4ef3f3a034e6d07f8ade3a64d18213b40b7 SHA-256: 3825e95e495a031ba6cdb3e75ad2cb0bd58e74d12c361c273c2238cc368c8b49

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.cc'. The document body, though heavily obfuscated, also contains this URL and appears to be a lure related to court case information. The presence of a large number of external PDF links, many hosted on cdn.shopify.com, suggests a link farm or SEO poisoning technique to distribute the malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=caroline+county+general+district+court+case+information
- https://static.usrfiles.com/ugd/45e30f_34b1891c6ff5467fb26cd86131ac41e4.pdf
- https://static.usrfiles.com/ugd/3f4b99_e61fd1c04abb43a493fac4f8f365c29e.pdf
- https://static.usrfiles.com/ugd/d2751c_6c8706cf536f4d9b9a7e4f3871353b79.pdf
- https://static.usrfiles.com/ugd/83b1b3_9fd9fcdf2b5b4263af48ce7bec91bc7b.pdf
- https://static.usrfiles.com/ugd/12dc78_7cee95b8ee414ba5af4b947421622866.pdf
- https://static.usrfiles.com/ugd/7e6083_431991aa214944968cdbebf9376bc0b6.pdf
- https://static.usrfiles.com/ugd/0d9a50_d37d65b8608b4e9bac8a14c93fff8f05.pdf
- https://cdn.shopify.com/s/files/1/0428/6794/9724/files/22186289961.pdf
- https://cdn.shopify.com/s/files/1/0433/0084/7781/files/mips_store_integer_in_register.pdf
- https://cdn.shopify.com/s/files/1/0443/4070/7484/files/pdf_to_jpg_converter_software_free_download_for_pc.pdf
- https://cdn.shopify.com/s/files/1/0432/7732/0348/files/86649143015.pdf
- https://cdn.shopify.com/s/files/1/0432/1270/1860/files/89907221528.pdf
- https://cdn.shopify.com/s/files/1/0431/4519/9777/files/najiletuxavamizibit.pdf
- https://cdn.shopify.com/s/files/1/0440/6214/6710/files/elementary_student_biography_template.pdf
- https://cdn.shopify.com/s/files/1/0428/4314/4355/files/77225212507.pdf
- https://cdn.shopify.com/s/files/1/0462/2086/9786/files/calorie_deficit_calculator_jillian_michaels.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d01.bin` `591ec2a579c718a5be364a6fd224e53e58f7764fd5f2e2b3191fe18b298e6bfc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D01	5348 bytes
`font_01_sfnt_off00006f1f.bin` `a440fc82c92058622687cbfe3c13879049e8ba848ba4a7dfc3e209714d49f5c8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F1F	10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.