PDF malware analysis — malicious · 89e6f9bddc2e06fb

MALICIOUS

PDF

44.7 KB Created: 2020-09-06 02:02:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a92a6f291904d485dfe7830f55fd8833 SHA-1: 22fa327118a1fb9ab7799f658bfe71e9964885b8 SHA-256: 89e6f9bddc2e06fb390c92e4f998a5b9d24498db9ffc1753e1baafeb6375b295

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that aligns with the identified malicious redirector. The presence of a large number of external PDF links, many pointing to the same dominant host, suggests a link farm used to obscure the ultimate destination or to manipulate search engine results.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=aggiornamenti+android+asus+zenfone+5
- https://static.usrfiles.com/ugd/b8c837_47b202d7a54d49bcb8fff20e4828ace3.pdf
- https://static.usrfiles.com/ugd/b8c837_7c129ede45344c8f9c428e1332799957.pdf
- https://static.usrfiles.com/ugd/a51aec_1ea290f20b9d439fa9294a635e5b5537.pdf
- https://static.usrfiles.com/ugd/120f26_bb208cc754fc48e4a91c516710a024d9.pdf
- https://static.usrfiles.com/ugd/bfbc46_70445757f3624718b5cd0b110eae8153.pdf
- https://static.usrfiles.com/ugd/89c6ad_8be5008c008d407ab4108b8a2767d990.pdf
- https://static.usrfiles.com/ugd/4c1554_f5697ea14e4e495aa85f2d320d7318f8.pdf
- https://static.usrfiles.com/ugd/934fc3_58ac58bc7ccc428aafeb5d6eacb1f5a5.pdf
- https://cdn.shopify.com/s/files/1/0434/0383/7591/files/engineering_statistics_5th_edition_download.pdf
- https://cdn.shopify.com/s/files/1/0436/1938/5502/files/zulesakobagu.pdf
- https://cdn.shopify.com/s/files/1/0430/8199/0295/files/33042712783.pdf
- https://cdn.shopify.com/s/files/1/0427/8432/5798/files/85580203273.pdf
- https://cdn.shopify.com/s/files/1/0431/5915/8938/files/70312043280.pdf
- https://cdn.shopify.com/s/files/1/0456/8501/4687/files/sarutekojemujufifotozi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000062a3.bin` `4034931c554dc1bfae6a7378c51fd9b7e9e9486e21a7466025c33aab7948b45f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62A3	5240 bytes
`font_01_sfnt_off0000745f.bin` `c244b272b65e8bd039912bf84c9785dbe62ee936f6ff97079e4d3c6848cbd9b0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x745F	10376 bytes
`font_02_sfnt_off000097cb.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x97CB	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.