PDF malware analysis — malicious · 519f73a8d0f07427

MALICIOUS

PDF

39.4 KB Created: 2020-09-05 13:50:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9836602e13fff858a1cef294bbcb0c7b SHA-1: 8f2550ddd099c0b4bf1b2255ddf030e1a992ea9d SHA-256: 519f73a8d0f0742701d2fda68f6efdd371eadbf19cb8ad50bb845346970bad94

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded links, with one specifically pointing to a known malicious redirector. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, contains references to the malicious URL and other benign-looking PDF links, suggesting a link farm or redirection scheme to deliver a payload.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=nagin+dance+song+dj+remix
- https://static.usrfiles.com/ugd/432b07_7b11205bc6af455c977cf13b90262600.pdf
- https://static.usrfiles.com/ugd/5bb01c_486827e06f8c4f3f83cda937f6e486b7.pdf
- https://static.usrfiles.com/ugd/b8c837_8d6aea8c2aee497888f58e33595ee7da.pdf
- https://static.usrfiles.com/ugd/217d68_b3c5134d1a9d4453b6b61798bc44e61d.pdf
- https://static.usrfiles.com/ugd/756799_da47f39ceb8d4b79919091f9756ef59e.pdf
- https://static.usrfiles.com/ugd/70094d_ef70418947c043e49759e937a71a1d93.pdf
- https://static.usrfiles.com/ugd/0789d5_c58476c56a9f43fa9c1920b199f63da9.pdf
- https://static.usrfiles.com/ugd/70e5f7_dded44d680394928b6e875149aa0a556.pdf
- https://static.usrfiles.com/ugd/c34aa9_ce5212ed1bef4c3a88352d7b284af210.pdf
- https://static.usrfiles.com/ugd/e3c460_738601142658447a8a441dc1569edb82.pdf
- https://static.usrfiles.com/ugd/c79b1c_5a8a062725cd48a3896a443aae564ca2.pdf
- https://static.usrfiles.com/ugd/6a22cb_b6bfc8fbca1d4bf78df594260b1b3d49.pdf
- https://static.usrfiles.com/ugd/f35da0_f440815bd4704c379905c30fcb3bf6f3.pdf
- https://static.usrfiles.com/ugd/1f5cef_91da1d9861a7458db30d3d316db893e1.pdf
- https://static.usrfiles.com/ugd/6812d7_0a3918fcd7b3441088377c7997ee0cbb.pdf
- https://static.usrfiles.com/ugd/ceb2e8_828d40b6075842f382c1ccced428649a.pdf
- https://static.usrfiles.com/ugd/40512e_b7bbb3cee44f495c944f9d6035ef3133.pdf
- https://static.usrfiles.com/ugd/268ab1_269a77e82a0e4816af9203cbb26018a8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000047f4.bin` `ac945d6fb5527817eacec1eeac0289409a177dae9605dcb2339ea8a746a7ad55`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x47F4	5048 bytes
`font_01_sfnt_off00005902.bin` `bcd42b32e7d238fce65e9eca624b02d5574df0b03ebdb3591f647649983e47b3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5902	12596 bytes
`font_02_sfnt_off0000809b.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x809B	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.