PDF malware analysis — malicious · 7c02d44c8aab9de1

MALICIOUS

PDF

42.0 KB Created: 2020-08-30 23:56:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a41246b2ff20013583374cb11985f424 SHA-1: 560b84dee58b9a923e7ab5c202460ae9f5a939e2 SHA-256: 7c02d44c8aab9de12b139b7909a959eee1847c849f6bf91e925fc5df343d8570

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file contains a critical heuristic firing for a malicious redirector link, specifically pointing to 'https://ttraff.cc/wix?keyword=birthday+images+and+videos'. The document body, though heavily obfuscated, also contains this URL, suggesting it's the primary lure. The presence of a large number of external PDF links, many hosted on cdn.shopify.com, indicates a link farm strategy to improve SEO and potentially distribute malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=birthday+images+and+videos
- https://cdn.shop
- https://cdn.shopify.com/s/files/1/0430/8277/6729/files/walking_with_purpose.pdf
- https://cdn.shopify.com/s/files/1/0432/9606/3652/files/60698130852.pdf
- https://cdn.shopify.com/s/files/1/0435/5027/7791/files/wibowezajofusudoz.pdf
- https://cdn.shopify.com/s/files/1/0462/5625/9221/files/boy_photo_full_hd.pdf
- https://cdn.shopify.com/s/files/1/0434/1497/8718/files/xeforigikapolalenizogurik.pdf
- https://cdn.shopify.com/s/files/1/0429/3227/3319/files/93457700967.pdf
- https://cdn.shopify.com/s/files/1/0427/6387/8566/files/xeporavilakekizu.pdf
- https://cdn.shopify.com/s/files/1/0432/3088/8094/files/rededalojenudigi.pdf
- https://static.usrfiles.com/ugd/0047a4_0a55c66e87454ea0bf10b766f8499390.pdf
- https://static.usrfiles.com/ugd/b8c837_428cec0b543d4fd7a34cd88414831e33.pdf
- https://static.usrfiles.com/ugd/b8c837_e4f7ac90e6dd4d6b9195487a5d661922.pdf
- https://static.usrfiles.com/ugd/4dd980_9c162979d90d4a25adecb7f6f81f53cd.pdf
- https://cdn.shopify.com/s/files/1/0429/3709/0211/files/sukilidijajigamijager.pdf
- https://cdn.shopify.com/s/files/1/0431/7036/5602/files/business_and_commercial_awareness.pdf
- https://cdn.shopify.com/s/files/1/0438/2641/3725/files/68338784043.pdf
- https://cdn.shopify.com/s/files/1/0434/9755/4084/files/sitij.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065dc.bin` `345858326a621bdbdbe9d6d3c450d90deb11db949ec8877733a0ed7ddabce3a7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65DC	5416 bytes
`font_01_sfnt_off00007833.bin` `05fca9816a56708c15b37946932cf11234b17831817e1e9f5e03d8ccad2daf26`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7833	10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.