PDF malware analysis — malicious · 3c863c5da8f0f369

MALICIOUS

PDF

42.5 KB Created: 2020-09-10 20:22:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 04051bd6b13ac82ad901a075ad487a6a SHA-1: b0b51d9c99f7e59528cdb770e2a8d5cf6c4386d7 SHA-256: 3c863c5da8f0f3690d284c667b51365889b88ba91f614d8e4b7c9e67154cd867

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to a known malicious domain, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text referencing 'Raja rani telugu movie emotional ringtones' and the malicious URL itself, suggesting a lure to entice users to click the link. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=raja+rani+telugu+movie+emotional+ringtones
- https://static.usrfiles.com/ugd/0aab01_f0d397cff4ce4adea8080fb39c62527f.pdf
- https://static.usrfiles.com/ugd/850f07_f0eb403dabda44f4aadec7290757e6c9.pdf
- https://static.usrfiles.com/ugd/760101_3e2699d02525496d8d29cadd0812acae.pdf
- https://static.usrfiles.com/ugd/7ad284_19681baba9184e91b801a67f5e7ea617.pdf
- https://static.usrfiles.com/ugd/8acad3_f369f48382274f3b9a68885f3d3713d6.pdf
- https://cdn.shopify.com/s/files/1/0430/9912/7957/files/54990888727.pdf
- https://cdn.shopify.com/s/files/1/0431/3264/9636/files/88818189669.pdf
- https://cdn.shopify.com/s/files/1/0434/5122/0124/files/nijuvubeposeb.pdf
- https://static.usrfiles.com/ugd/b8c837_14d8d984de324ca39cffe21bbbbdfa34.pdf
- https://static.usrfiles.com/ugd/822ecd_d0b12cacf78a43fcb2a51b0f8d75edb8.pdf
- https://static.usrfiles.com/ugd/162fe6_72b137efd9e64516914c6accdab0c4a7.pdf
- https://static.usrfiles.com/ugd/a8c229_cff70997403b433f8d92bc6dd4e4a5ae.pdf
- https://cdn.shopify.com/s/files/1/0437/2230/9786/files/bodybuilding_nutrition_plan_building_muscle.pdf
- https://cdn.shopify.com/s/files/1/0435/2871/6440/files/asignatura_estatal_primero_de_secundaria_2020.pdf
- https://cdn.shopify.com/s/files/1/0434/3683/4981/files/wofibevijuv.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005297.bin` `641303795f07484cd06fa3872252fe3ff9db134945a730599fffa081dc363141`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5297	5148 bytes
`font_01_sfnt_off00006416.bin` `c7fd17cdeb87b449f044cdd79e44a5feb07d864b51e657e64d0965cfffe0f702`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6416	9600 bytes
`font_02_sfnt_off00008524.bin` `cc86994599ca2b6bade3ef2a24080e5ca7d0105f80c2e61a4a6d43fb5994c661`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8524	16684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.