PDF malware analysis — malicious · 4c8b5d73f41acc81

MALICIOUS

PDF

82.1 KB Created: 2020-09-11 17:40:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9f43bb35f1423b589e75716308b0b9c8 SHA-1: 428f2fb643f83c01ae45cffc44946136e7d13626 SHA-256: 4c8b5d73f41acc81fba6cd60cdb1f112b8d96ca96b18537314bd5a35b92947a8

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a prominent link to 'ttraff.me', identified as a malicious redirector. This URL is presented within the document body, disguised as a link to a PDF about root canal treatment. The PDF also contains a large number of external links, many pointing to Shopify, suggesting a link farm or SEO manipulation tactic to increase visibility. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=root+canal+treatment+procedure+pdf
- https://cdn.shopify.com/s/files/1/0432/4550/2626/files/24949250370.pdf
- https://cdn.shopify.com/s/files/1/0438/7602/4475/files/hasbro_clue_jr_sheets.pdf
- https://cdn.shopify.com/s/files/1/0429/1048/2591/files/familia_rubiaceae_caracteristicas.pdf
- https://cdn.shopify.com/s/files/1/0431/5060/6496/files/wafigunupez.pdf
- https://cdn.shopify.com/s/files/1/0440/6296/5912/files/47625043551.pdf
- https://static.usrfiles.com/ugd/d3758e_4c268092509c4677a503c97c3213964c.pdf
- https://static.usrfiles.com/ugd/b41a9a_d4162dd0ec6c48fca308f5f6a3351e25.pdf
- https://static.usrfiles.com/ugd/eb6612_577bf5f08781455bb2f3ce0a411bfd70.pdf
- https://static.usrfiles.com/ugd/dfb5f8_2595e7a11e3b42fc88792638829351ad.pdf
- https://static.usrfiles.com/ugd/ced2dc_d126fec19d6b4bd1a2e88b8cdd5d166e.pdf
- https://cdn.shopify.com/s/files/1/0430/2805/4169/files/4232248265.pdf
- https://cdn.shopify.com/s/files/1/0428/6650/7943/files/kezelaveripasezisibami.pdf
- https://cdn.shopify.com/s/files/1/0438/8447/8632/files/rational_fasting_arnold_ehret.pdf
- https://cdn.shopify.com/s/files/1/0435/4310/1591/files/xonisivixata.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d8ae.bin` `a4add50da0dfd1e71f2b022fd3b9b0ab912b37de1191fdf661cf5a456426e503`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD8AE	9072 bytes
`font_01_sfnt_off0000f6b3.bin` `a24609bf560d5f85e4a0b1b0108f3a8137a53f250bab401ff12128f7993b15b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF6B3	4964 bytes
`font_02_sfnt_off0001077b.bin` `34c3530f469d5b84ee8086a2a057cdf381823275226df6c4be116800c42286ed`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1077B	10916 bytes
`font_03_sfnt_off00012c75.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12C75	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.