PDF malware analysis — malicious · 4e9874864cc84dbf

MALICIOUS

PDF

42.9 KB Created: 2020-08-28 23:42:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: bd1de07cd58956644944cd8b4d1d9411 SHA-1: 6cd788c3dbee85e54041135d1006c36739b41af8 SHA-256: 4e9874864cc84dbf2e7b0d191024029e750234193c65f016838aa6e7ef153b35

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of embedded links, characteristic of a link farm designed to manipulate search engine rankings or redirect users to malicious sites. The primary redirector URL, https://ttraff.ru/wix?keyword=chick+fil+a+marketing+strategies, is flagged as malicious. The document body, though heavily obfuscated, also contains this URL and other Shopify links, suggesting a coordinated effort to distribute malicious content through seemingly benign documents.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=chick+fil+a+marketing+strategies
- https://cdn.shopify.com/s/files/1/0435/2675/0359/files/mini_international_neuropsychiatric_interview_7._0._2.pdf
- https://cdn.shopify.com/s/files/1/0428/9314/8313/files/88138015427.pdf
- https://cdn.shopify.com/s/files/1/0436/4910/6073/files/virufilobubewal.pdf
- https://cdn.shopify.com/s/files/1/0429/4000/6559/files/job_ka_full_form_kya_hai.pdf
- https://cdn.shopify.com/s/files/1/0434/2457/9751/files/jegaw.pdf
- https://static.usrfiles.com/ugd/b8c837_12918248429a48a5a194bf0ac226cdbc.pdf
- https://static.usrfiles.com/ugd/b8c837_63709972f7bb491fa0b25fc2089647cc.pdf
- https://static.usrfiles.com/ugd/b8c837_508655159a0645a7909732b7f5967ee4.pdf
- https://static.usrfiles.com/ugd/b8c837_adcc115665af4fb4aed394875277abb9.pdf
- https://static.usrfiles.com/ugd/b8c837_d68c0965a14c4a3083f3c9f0077d06fc.pdf
- https://static.usrfiles.com/ugd/b8c837_6095cd605a4b43bca7bb6f59728d8c0f.pdf
- https://static.usrfiles.com/ugd/b8c837_bb1c2cc5fe0c464d98a326934d4d392c.pdf
- https://static.usrfiles.com/ugd/b8c837_10c490bdd8774643ac54b12024c3efec.pdf
- https://static.usrfiles.com/ugd/b8c837_0cbffd95719a48abb4eb29ecff715736.pdf
- https://static.usrfiles.com/ugd/b8c837_cf3e10c080e9492e8cd5ef00654012a3.pdf
- https://static.usrfiles.com/ugd/b8c837_9cd1557c1c2947198157ca595f286777.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000068a6.bin` `c6d9a82f42bb16a10a25183639e7514b52c4df01a29353a270236cc90e6ac0c2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x68A6	5264 bytes
`font_01_sfnt_off00007a66.bin` `4a7e86d685906201558d17eb06aeba4f418012376a4959a9dcf406e667c24a8c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A66	10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.