PDF malware analysis — malicious · 511c7f3be9d4e782

MALICIOUS

PDF

43.8 KB Created: 2020-09-07 23:05:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0196f103e5d76c9af3f298757f74e2f9 SHA-1: 4b88e1a64696e12823afd8b2faac762233a51e56 SHA-256: 511c7f3be9d4e782f1fd2ae7f729d94aa50e5270123c5c632a8cdb9130b2e8ff

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged as malicious due to a critical heuristic identifying it as a redirector link to known malicious infrastructure. Additionally, it contains a large number of external PDF links, characteristic of a link farm. The embedded URL 'https://ttraff.club/pify?keyword=sports+football+information' is the primary indicator of malicious intent, likely serving as a lure or redirect to a phishing site or malware download. The document body contains garbled text but does include the malicious URL and several benign-looking URLs from static.usrfiles.com.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=sports+football+information
- https://static.usrfiles.com/ugd/544c7e_57fbcf354ee44f5dada1ce4aa541bce5.pdf
- https://static.usrfiles.com/ugd/0fdb6d_e5fe65ba4607488cb981935011517fd9.pdf
- https://static.usrfiles.com/ugd/b7ab08_ebfb2487611248ef94196c95c6636e50.pdf
- https://static.usrfiles.com/ugd/9f69bd_8667486fa1084edd93e456b15433a087.pdf
- https://static.usrfiles.com/ugd/856cea_695e1c2df83a4120837b30b5ee0b8ecc.pdf
- https://static.usrfiles.com/ugd/53c654_ad3dc025d23948838952d9e4d0bf49f2.pdf
- https://static.usrfiles.com/ugd/9c58c5_63d6028953c443a7a35336d55d1a8556.pdf
- https://static.usrfiles.com/ugd/b8c837_60aefdf27c8640259bb89050a311a25f.pdf
- https://static.usrfiles.com/ugd/7f16bd_adca5f5ebffa4cad86077a94be4cc860.pdf
- https://static.usrfiles.com/ugd/b8c837_107871a511b54473afb38051ef128d10.pdf
- https://static.usrfiles.com/ugd/ceb2e8_92b46a51de0d4ea282cba0b2d8d10e13.pdf
- https://static.usrfiles.com/ugd/99965f_a698fc67fed9451a890c2c3f8d7233cc.pdf
- https://static.usrfiles.com/ugd/df4650_f9579425cbac41da99e408d4575573c5.pdf
- https://static.usrfiles.com/ugd/d13e1f_01c2e64ac12342e480d17d55435b2fd5.pdf
- https://static.usrfiles.com/ugd/2d1648_5de4dc23f12f477e9b164e33450c0a5f.pdf
- https://static.usrfiles.com/ugd/5a4aad_ee61852cb0e541a39102987466716191.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006c8f.bin` `ed14a9ed19d4650d503d5bb1b654327d41aae341da623f6e64e5b7595b6c34da`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C8F	5292 bytes
`font_01_sfnt_off00007e70.bin` `814b8597e1c4475f4803d1e59cee2b6c6306d3c321834164d3e6c71e10f86672`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E70	10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.