PDF malware analysis — malicious · 3a97fb1d03d8119d

MALICIOUS

PDF

42.8 KB Created: 2020-08-29 07:08:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0189decc764be99343620d30f15b400b SHA-1: a5484f3f004248ec99595c4941d5fa6ad93f6969 SHA-256: 3a97fb1d03d8119d9bbb4f33d8c1676307c5d2631daf5e65a8605e78a73b1e20

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was identified as malicious due to the presence of a large number of external links, characteristic of a link farm. One of these links, https://ttraff.cc/wix?keyword=wow+part+of+speech, points to known malicious redirector infrastructure. The document body contains garbled text but includes the same malicious URL and a benign-looking PDF URL, suggesting a lure to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=wow+part+of+speech
- https://static.usrfiles.com/ugd/b8c837_f86210dab46140d2aa205a30258b3991.pdf
- https://static.usrfiles.com/ugd/b8c837_b65c760b31a648a095036790a0873184.pdf
- https://static.usrfiles.com/ugd/b8c837_8297bee6c147423da32f043919b6937f.pdf
- https://static.usrfiles.com/ugd/b8c837_90fcb2153c0c4348be5e14905b17cfb0.pdf
- https://static.usrfiles.com/ugd/b8c837_c76a66380c9f4b50990411721f5d42fe.pdf
- https://static.usrfiles.com/ugd/b8c837_3e866402209b4a83b948a68f0bf0a07d.pdf
- https://static.usrfiles.com/ugd/b8c837_a5d7dc1cfffc4c32bd88f0a002258f45.pdf
- https://static.usrfiles.com/ugd/b8c837_5acd9ac1fd20458884f93b90043b3982.pdf
- https://static.usrfiles.com/ugd/b8c837_61d9d0763a574bbc9cf8f15926b14db5.pdf
- https://static.usrfiles.com/ugd/b8c837_7833f64966f34f469fad80d53459a300.pdf
- https://static.usrfiles.com/ugd/b8c837_e4323a003c2a4f70a9d681c3d6c78536.pdf
- https://static.usrfiles.com/ugd/b8c837_a31f4755ef0d459a8a6ac09582c428db.pdf
- https://static.usrfiles.com/ugd/b8c837_fb7f2479483b46509ae1b8bf42284415.pdf
- https://static.usrfiles.com/ugd/b8c837_577d03c2bc6a44589703ca04f8528cd5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006848.bin` `51479dfaf638b9d9d250d8d3d1972bedbd83206860653519912a420b5f384f41`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6848	5176 bytes
`font_01_sfnt_off000079f8.bin` `0cf21f3b2ed398265f7e31d04f1c7cdf64015225d967e1cb5b7e0f0a56480262`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79F8	10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.