PDF malware analysis — malicious · 440c68b2f8d84d11

MALICIOUS

PDF

34.4 KB Created: 2020-08-30 05:52:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a432dcfc3a24b99c3fc5021ae2bcc7d5 SHA-1: 2866b9de27f62929e4bea94e0aa7913f19bf897e SHA-256: 440c68b2f8d84d117001cee3a2d1f251445deed1de290fcd296ea4a855fca80b

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, indicating it directs users to malicious infrastructure. The embedded URL https://ttraff.com/wix?keyword=makita+dc18rc+instructions, disguised as 'Makita dc18rc instructions', is the primary lure. The file also exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs, suggesting a broader campaign to distribute malicious content or manipulate search engine results. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=makita+dc18rc+instructions
- https://static.usrfiles.com/ugd/3e87bf_1d0d859c5b8d459da2ad2abcd72712ba.pdf
- https://static.usrfiles.com/ugd/1c8c6c_81c1db226fbc4aea84be434804261741.pdf
- https://static.usrfiles.com/ugd/ea2f88_c8f6d9136413464ca2ead067ebafed3d.pdf
- https://static.usrfiles.com/ugd/1decf9_76c34e42d7594f9c81ff77ae18557d36.pdf
- https://static.usrfiles.com/ugd/b8c837_a312723ff3914a8086a5fc758ffccd1b.pdf
- https://static.usrfiles.com/ugd/4bb894_404d959bb89f4df9af68d665e34601ff.pdf
- https://static.usrfiles.com/ugd/b8c837_0fe6bfb818604b0380d7754413a4b16e.pdf
- https://static.usrfiles.com/ugd/0bcf16_633e02673b694f3283a1655c8b208504.pdf
- https://static.usrfiles.com/ugd/b8c837_5b07c5737e394be2a518881186bb99aa.pdf
- https://static.usrfiles.com/ugd/accd1f_d21f9ccef9ff4d47a679b48e2e6679ac.pdf
- https://static.usrfiles.com/ugd/b8c837_607e5fb06bcc44f8b07ec7d86fae0efb.pdf
- https://static.usrfiles.com/ugd/b8c837_b1dd12f2921e4ba1bb4d86d1fff3773f.pdf
- https://static.usrfiles.com/ugd/b8c837_5f3315c5e7464f1bb0f3d6fda657370a.pdf
- https://cdn.shopify.com/s/files/1/0431/6296/0023/files/modal_auxiliary_verb_list_english.pdf
- https://cdn.shopify.com/s/files/1/0431/1806/7876/files/kerir.pdf
- https://cdn.shopify.com/s/files/1/0432/7302/7749/files/vaditudemumozopesevu.pdf
- https://cdn.shopify.com/s/files/1/0432/9183/6566/files/61534441533.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000497a.bin` `ba64602e585a8cfc6fb155b38fb606900c88a22172257a4e57b907ddf7b1eacb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x497A	5216 bytes
`font_01_sfnt_off00005b45.bin` `c84558a0578908f036e870b2aa184cb866bcece6b766282b81e186e6430ea8f5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B45	10188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.