PDF malware analysis — malicious · 59e0c4e0726c37a0

MALICIOUS

PDF

69.3 KB Created: 2020-08-29 03:15:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: aa59b4da254aeacedb5a7aa2a2df5682 SHA-1: f5fc36b38d12dce0312e8af69b750dd454e36eb2 SHA-256: 59e0c4e0726c37a0d616238d841a9e7ff59a48c25d0274dfc055ca6546813de2

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.ru, which is disguised as a 'Senior patrol leader handbook'. This suggests a phishing or social engineering attack aimed at redirecting users to malicious content. The PDF also exhibits characteristics of a link farm, with numerous external links, further supporting the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=senior+patrol+leader+handbook
- https://static.usrfiles.com/ugd/b8c837_5d758355a40747b78d801443d6e8c92f.pdf
- https://static.usrfiles.com/ugd/b8c837_5923b805eb664552976164a5048134d4.pdf
- https://static.usrfiles.com/ugd/b8c837_997157d551bc4884a913108b97e2cfbe.pdf
- https://static.usrfiles.com/ugd/b8c837_a4503845d5b84f0ca63de83f4af63989.pdf
- https://static.usrfiles.com/ugd/b8c837_3fbf20b3a4684a5ba762c53a39b1ad9c.pdf
- https://static.usrfiles.com/ugd/b8c837_924976c92036418caa81c284af223ef3.pdf
- https://static.usrfiles.com/ugd/b8c837_dd683b0eeb184becba5b53404da3e5b5.pdf
- https://static.usrfiles.com/ugd/b8c837_2cc151931659490da406f5a076073cb9.pdf
- https://static.usrfiles.com/ugd/b8c837_d5c2cf93c6d043be8a06f2c6d6083b17.pdf
- https://static.usrfiles.com/ugd/b8c837_5534b1fd798b4bd2ab91d8ec39330eb0.pdf
- https://static.usrfiles.com/ugd/b8c837_a3fad402974c48eda4ff995286b5a2a6.pdf
- https://static.usrfiles.com/ugd/b8c837_3bd8830d35ba4391b53be5fa57fbe761.pdf
- https://static.usrfiles.com/ugd/b8c837_2724b14bc9f34f6b901553caa3dcf04c.pdf
- https://static.usrfiles.com/ugd/b8c837_84aa15f310db454fb859f21775e70940.pdf
- https://static.usrfiles.com/ugd/b8c837_dc995817c58b4ba49f064593be302df5.pdf
- https://static.usrfiles.com/ugd/b8c837_e175e5fc7a024085aeb4e680d025616e.pdf
- https://static.usrfiles.com/ugd/b8c837_86d3e3027366436b80a3352bdbbf305f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c007.bin` `4aba2bb845853324476be69e5ed1bf4ff35002942389efac2b843cac1129f0e9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC007	2828 bytes
`font_01_sfnt_off0000ca02.bin` `e1db96ca7650f2db1718a38baa4598439bd5232a1650ba14dfcf54d1e9401566`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA02	5176 bytes
`font_02_sfnt_off0000db80.bin` `010fe18e7c80589cabe3f1faef751587199d76406b26eb6e421ed5a6c355a458`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB80	13320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.