PDF malware analysis — malicious · 4c3d84e3ee51740f

MALICIOUS

PDF

38.5 KB Created: 2020-09-10 11:04:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c80648e5a4eeb1571a8dfeb61d634b74 SHA-1: b58dc8a100b0dead1847e67278158759d7a6202e SHA-256: 4c3d84e3ee51740f96eedf3a522225b541073ea46e781145da480e62048f4a7a

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded URLs, with one specifically identified as a malicious redirector. The ML classifier strongly indicates maliciousness. The primary malicious URL, 'https://ttraff.me/pify?keyword=external+style+sheet+code', likely serves as a lure to a phishing site or a download host for further malicious payloads. The presence of numerous other benign-looking PDF links suggests a link farm or a tactic to obscure the malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=external+style+sheet+code
- https://static.usrfiles.com/ugd/314c35_bf811d15c0ef4ce6ae2889b505e208bf.pdf
- https://static.usrfiles.com/ugd/a374b9_946f8844eced4015981cf1fe8875c291.pdf
- https://static.usrfiles.com/ugd/22739b_686a73f3432948b0b96ed0116e1d03e7.pdf
- https://static.usrfiles.com/ugd/c6ac46_ec3936f744454e99a23cc6e49b2967dc.pdf
- https://cdn.shopify.com/s/files/1/0435/6754/6527/files/dekoximobobipakegunu.pdf
- https://cdn.shopify.com/s/files/1/0437/5999/2990/files/play_live_tv_apk_2019.pdf
- https://cdn.shopify.com/s/files/1/0457/8652/9948/files/20303954467.pdf
- https://static.usrfiles.com/ugd/10e3af_f6f54280f4d3406aa9c6cb2e233a092a.pdf
- https://static.usrfiles.com/ugd/d5cf39_c82ee83048ed48f8a97ee882ac0672d6.pdf
- https://static.usrfiles.com/ugd/469aea_6141ce14a9174405bc070f4107664728.pdf
- https://cdn.shopify.com/s/files/1/0432/8249/7696/files/seratunigemolufofo.pdf
- https://cdn.shopify.com/s/files/1/0428/1267/0111/files/89917981344.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000051f2.bin` `4aaecf203a402ef8b30d82ec74da756c134253fb91776131ffc6a6e6a9c0ce1c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51F2	5152 bytes
`font_01_sfnt_off0000637b.bin` `085aeae00c140d9877701a0c1c601d5df88ad19a631733d9bd6863e5fa297558`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x637B	12928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.