PDF malware analysis — malicious · 45570d88032fefbf

MALICIOUS

PDF

81.2 KB Created: 2020-08-31 09:14:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b58456ed2242a86b7cbbd341bd3787e1 SHA-1: cca7c5083297cd2750a9531916ccb722c466b06e SHA-256: 45570d88032fefbf168d0005dd1792e8db6fe51b55ebd5f31d054b1dc971db98

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF document contains a high number of embedded links, many of which point to external resources. One critical heuristic identified a link to a known malicious redirector infrastructure at 'https://ttraff.com/wix?keyword=what+is+e-atx'. The document body, though heavily obfuscated, contains this URL, suggesting the primary intent is to redirect the user to a malicious site. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=what+is+e-atx
- https://cdn.shopify.com/s/files/1/0427/7341/4055/files/6520481370.pdf
- https://cdn.shopify.com/s/files/1/0437/0379/5865/files/antioxidant_activity_plant_extracts.pdf
- https://cdn.shopify.com/s/files/1/0430/1458/6517/files/bukorisozot.pdf
- https://cdn.shopify.com/s/files/1/0435/4415/0165/files/shell_bargaining_for_advantage.pdf
- https://static.usrfiles.com/ugd/b8c837_41934b2beee5442ca25610b90fd6c930.pdf
- https://static.usrfiles.com/ugd/7f16bd_91e609012c0e46ebbcddf5338e1a06b5.pdf
- https://static.usrfiles.com/ugd/234f58_1f162feebf5c4bf7aac7d8853640b41d.pdf
- https://static.usrfiles.com/ugd/dc8a8e_f4c34c3343264c81a243b4ca3104ddb1.pdf
- https://cdn.shopify.com/s/files/1/0430/0174/1463/files/95913502253.pdf
- https://cdn.shopify.com/s/files/1/0429/6006/0567/files/xivemokazinu.pdf
- https://cdn.shopify.com/s/files/1/0428/8466/1414/files/infinite_stratos_season_1.pdf
- https://cdn.shopify.com/s/files/1/0438/3539/2150/files/free_bodybuilding_workout_programs.pdf
- https://static.usrfiles.com/ugd/599026_a961bee8796f41f8a0e90f0897811dae.pdf
- https://static.usrfiles.com/ugd/b8c837_2d77f2b57c8a43fd8b1c7c0d218342df.pdf
- https://static.usrfiles.com/ugd/defcb2_02827a72225b4bc6bbfcb812b0cf4027.pdf
- https://static.usrfiles.com/ugd/97493d_77de7e6da9634d63b48c245fe019b266.pdf
- https://static.usrfiles.com/ugd/accd1f_7bc6ac68a006401ba7b75b4238ff24ba.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f99b.bin` `f18bbeafc07c0acff1fde28ccbce854240c059af76d2d1733788c1a14b369fbf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF99B	4756 bytes
`font_01_sfnt_off000109dd.bin` `c2335014f426340a22797aae83ffc4dca1f45f1ff27e5d837272d712c83bc51f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x109DD	14396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.