PDF malware analysis — malicious · 3b6d6a353de9d272

MALICIOUS

PDF

43.9 KB Created: 2020-08-20 14:59:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b9b6a1d076709352408f69faf7e28694 SHA-1: 27521c202585642d5882638569b0ee8f0e3bc440 SHA-256: 3b6d6a353de9d272df676621d8aa8419fa27b70c65c6a4fb69872d7ce3979499

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links, many of which point to external PDF files hosted on various domains. One of the primary links, 'https://ttraff.ru/pify?keyword=treatment+guidelines+for+constipation+in+pediatrics', is identified as a malicious redirector. The document body itself is heavily obfuscated but contains references to this malicious URL and other benign-looking Shopify URLs, suggesting a link farm designed to distribute malicious content or engage in SEO poisoning.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=treatment+guidelines+for+constipation+in+pediatrics
- http://files.monarchmountainretreat.com/uploads/1/3/2/7/132740692/ce2d2.pdf
- http://posimulen.wheektown.com/uploads/1/3/0/7/130775897/298188.pdf
- http://files.arkspeakingandtraining.com/uploads/1/3/1/3/131384101/rijefufediv.pdf
- http://files.qmworkplacement.com/uploads/1/3/2/6/132682882/6141691.pdf
- http://files.olgabaptist.org/uploads/1/3/0/7/130776407/makotapiv-jozan-jakabiwunabafom-tezejore.pdf
- https://cdn.shopify.com/s/files/1/0432/3088/8094/files/76170331275.pdf
- https://cdn.shopify.com/s/files/1/0437/7948/9950/files/netgear_dynamic_dns.pdf
- https://cdn.shopify.com/s/files/1/0431/3359/9893/files/62886493460.pdf
- https://cdn.shopify.com/s/files/1/0434/5312/0664/files/87834773486.pdf
- https://cdn.shopify.com/s/files/1/0435/2458/7674/files/kejonutuvivilefaxogifu.pdf
- https://cdn.shopify.com/s/files/1/0431/4827/9957/files/19730196774.pdf
- https://cdn.shopify.com/s/files/1/0428/3141/3415/files/61260622510.pdf
- https://cdn.shopify.com/s/files/1/0434/8510/2237/files/zowigumesevovuwamoz.pdf
- https://cdn.shopify.com/s/files/1/0437/6123/8168/files/totototurolarobu.pdf
- https://cdn.shopify.com/s/files/1/0429/2355/7030/files/22149877354.pdf
- https://cdn.shopify.com/s/files/1/0434/3431/1845/files/90016603378.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006aeb.bin` `1a05dbb458114172fb0465a52348acad6b4b0357ef45a511edadb18db841559e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AEB	5424 bytes
`font_01_sfnt_off00007d46.bin` `5c4849f4b362cede366f5ce87fa29f83f460996af0b0531a383d4c464df4960b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D46	10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.