PDF malware analysis — malicious · 791bb466d3bbce4c

MALICIOUS

PDF

42.5 KB Created: 2020-09-01 11:41:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b58eabdb2df1960bb3197d975fbce3d5 SHA-1: 6404ed436f7bb08b32ae48112b6e95b26a3fdcb9 SHA-256: 791bb466d3bbce4c1dfa032782cd7293c76260910b2ced93617f902daf5562f2

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains embedded links that redirect to malicious infrastructure, specifically identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, appears to be a lure related to a sports match report. The primary malicious IOC is the redirector URL, which is designed to lead users to further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=manchester+united+vs+bournemouth+match+report
- https://static.usrfiles.com/ugd/cc03df_05de3a5024894ad4badf5a87b71e9086.pdf
- https://static.usrfiles.com/ugd/8de238_2b76d9ad39914b10b47fbb4db8e3a807.pdf
- https://static.usrfiles.com/ugd/b8c837_bbbfd0603f3e4887bbdb92b5c4ab1d31.pdf
- https://static.usrfiles.com/ugd/dd4472_763940ed23914b1e99bc35649c16c88e.pdf
- https://static.usrfiles.com/ugd/b8c837_01bf716fa43747cb81617682ec72c318.pdf
- https://static.usrfiles.com/ugd/9e41f0_ab64b430635f4a168b7fbc80ecc3d5dd.pdf
- https://static.usrfiles.com/ugd/963627_ac4512ab77e24c5d8fde00aa40f2778f.pdf
- https://static.usrfiles.com/ugd/b8c837_2e9be0217a2c438ca5ca0ecfe9722218.pdf
- https://static.usrfiles.com/ugd/1fa6dd_4a5020cddbe84f259c502ae8432ba0e3.pdf
- https://static.usrfiles.com/ugd/ae15ca_5cb123ca145f4c5aa30ce89a327cdece.pdf
- https://static.usrfiles.com/ugd/704566_ca38a084de4b480bbc5ee36a93a4127c.pdf
- https://static.usrfiles.com/ugd/cf14a4_4286de5c6e254b83bd4844922275953c.pdf
- https://static.usrfiles.com/ugd/de65f7_47104b4f3e29455db5358c37cecf5c95.pdf
- https://static.usrfiles.com/ugd/2074c9_1a8ded89f81d456ea3f5350486ef8147.pdf
- https://static.usrfiles.com/ugd/d43733_32795166d00f4d88b0b62101d2bf849e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000068c0.bin` `1acaea1806de27be54726a808cf6945faded9abdec28e1cf6899a359e234e861`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x68C0	5488 bytes
`font_01_sfnt_off00007b47.bin` `b1854a91248c7ab9090cdd0e5e05b95121502e3396273a7033cefcd4943b8d1e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B47	9888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.