PDF malware analysis — malicious · 852b4acb5e4d1f0d

MALICIOUS

PDF

55.1 KB Created: 2020-08-07 09:01:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a2a3b584bdac0ba0ab058c2ef4ea9161 SHA-1: 6b8b6c12aa7b3c7977f6a6cf5c414d36ded1bf04 SHA-256: 852b4acb5e4d1f0d983b3eaa58f512cc05f0ca35a4bfdaca540f48e8a972c00c

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains heuristics indicating it's a malicious redirector and part of a link farm, aiming to direct users to external content. The primary malicious URL identified is ttraff.com, which is used in conjunction with a book title lure. While no scripts were extracted, the PDF structure and embedded URLs strongly suggest a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=arthur+conan+doyle+as+aventuras+de+sherlock+holmes+pdf
- http://files.decadesvintage.co.uk/uploads/1/3/1/6/131606035/9107723.pdf
- http://files.northstarelite.org/uploads/1/3/0/7/130775598/refetajovefamavub.pdf
- http://files.oneined.com/uploads/1/3/1/0/131069898/gejose_donemadas_zorovawufirito.pdf
- http://files.truckelele.com/uploads/1/3/1/4/131452904/16b6ab8cd29.pdf
- https://cdn.shopify.com/s/files/1/0429/6402/5493/files/daluzubona.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/pegumi.pdf
- https://cdn.shopify.com/s/files/1/0430/7763/2154/files/26901684036.pdf
- https://cdn.shopify.com/s/files/1/0433/7208/5406/files/7283871174.pdf
- https://cdn.shopify.com/s/files/1/0438/0868/6237/files/list_of_aluminum_alloys_and_properties.pdf
- https://cdn.shopify.com/s/files/1/0436/9973/2635/files/59910107001.pdf
- https://cdn.shopify.com/s/files/1/0432/7748/4196/files/python_nested_list.pdf
- https://cdn.shopify.com/s/files/1/0436/4029/1486/files/27386502768.pdf
- https://cdn.shopify.com/s/files/1/0429/2821/0073/files/62181198040.pdf
- https://cdn.shopify.com/s/files/1/0438/2910/0701/files/39255331349.pdf
- https://cdn.shopify.com/s/files/1/0432/5897/0280/files/supiw.pdf
- https://cdn.shopify.com/s/files/1/0437/8106/2805/files/92566436288.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008b74.bin` `733fe082241dd0435776449b1385e8303ad0611b354b47a290042c365f6e7dd4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B74	5444 bytes
`font_01_sfnt_off00009dd7.bin` `6549d75e30da6e0588892dacaf888d626321fce75e1fdfacc8c218693898d074`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9DD7	10224 bytes
`font_02_sfnt_off0000c0b2.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC0B2	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.