PDF malware analysis — malicious · 8495f7674a97305e

MALICIOUS

PDF

40.2 KB Created: 2020-09-19 07:50:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a22934a7d3731a1b98b54017d1e819c3 SHA-1: e26aec47f8d7381d98e5e2df8939c3530e9f5c5a SHA-256: 8495f7674a97305e7d0040453ece6034d084724f6a4bc6730f22e34a76b82cfa

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The embedded URLs, such as 'https://ttraff.link/wix?keyword=weber%2527s+least+cost+theory+worksheet', are likely part of a phishing or malware distribution campaign. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the sheer volume of suspicious links points to a content-driven attack.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=weber%2527s+least+cost+theory+worksheet
- http://mamove.allanmasseycenter.com/uploads/1/3/1/8/131871768/8ed7a02fbe913.pdf
- http://files.heartlandjungians.org/uploads/1/3/0/7/130776841/ziniruper.pdf
- http://nojebak.shopvintagedallas.com/uploads/1/3/2/6/132682646/c9c347e.pdf
- https://cdn.shopify.com/s/files/1/0438/7209/2315/files/lulipovevodonetodug.pdf
- https://cdn.shopify.com/s/files/1/0464/2507/9960/files/kafazibadanorevaritoxug.pdf
- https://cdn.shopify.com/s/files/1/0440/6706/1910/files/bamalojizesotitesarodabo.pdf
- https://cdn.shopify.com/s/files/1/0440/7338/6136/files/62406987951.pdf
- https://eeaf85de-a2c9-43ee-b3ed-7f1133a6d06b.filesusr.com/ugd/51c472_796ac73345d84565b99c5f76f6da99ff.pdf?index=true
- https://903ac84f-ee0b-4ded-a999-f9424e7b8d75.filesusr.com/ugd/9d869b_f95025b8cedc4a66b7dd36f595691df0.pdf?index=true
- https://b3265e5c-613a-44ba-8edd-1d84dd4bee42.filesusr.com/ugd/09c3c7_2639e805a67b461a80852c427ea21982.pdf?index=true
- https://fdd11189-42f4-4224-b4ae-cfacd823368b.filesusr.com/ugd/c450b2_2ea4a122c1fb4fa19dc1886cafbe94ea.pdf?index=true
- https://8d58a088-b7cb-4868-b241-1765adc1911d.filesusr.com/ugd/debbe1_c74cda3f8d534ac0bfe45fb3f2a7328c.pdf?index=true
- https://54463c45-ecfc-45ac-837d-39ddc9575694.filesusr.com/ugd/1b9faa_e99cdb55f34a4d2ca9c609051efc8266.pdf?index=true
- https://eeb47d73-9ff0-4d8d-af10-574d958a61e0.filesusr.com/ugd/575363_a5e87753445d40389e582eb045b90045.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d69.bin` `695b2cee42a4c5a6268cd0b3b2b692205a04df5b05a3c19e7deab7bf1d9dc5c0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D69	5332 bytes
`font_01_sfnt_off00006fa6.bin` `7282618c47d0e558b76be67073276192e31e3d51b04143bbe1f6695895beed0d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6FA6	10716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.