PDF malware analysis — malicious · 8bec53109f9acf69

MALICIOUS

PDF

44.0 KB Created: 2020-09-10 03:47:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 01ad45661ef98005537eec09de99f869 SHA-1: 2a271813d148f814421b6ec007a2dcf3af53172a SHA-256: 8bec53109f9acf6978d08772e9534492683f0464e54385e32acddc8353e8d0b3

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a mass external link farm, with a critical heuristic firing for a malicious redirector link. The embedded document body, though heavily obfuscated, contains the URL 'https://ttraff.link/wix?keyword=hengistbury+head+fishing+report', which is also listed as a malicious redirector. This suggests the document's primary purpose is to redirect users to malicious infrastructure, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=hengistbury+head+fishing+report
- https://static.usrfiles.com/ugd/516793_f6a90704835a4f2b830ce6fab9cfd2c7.pdf
- https://static.usrfiles.com/ugd/136d07_e55f7002c2d04a1bb4829f7232380261.pdf
- https://static.usrfiles.com/ugd/205ae4_8f24919e5a9f4021a4e3708f7b6bc88c.pdf
- https://static.usrfiles.com/ugd/9904c2_f59a72f3c75542b6a97d11be283984eb.pdf
- https://cdn.shopify.com/s/files/1/0435/2563/6250/files/breaking_the_habit_of_being_yourself_summary.pdf
- https://cdn.shopify.com/s/files/1/0457/4088/4124/files/xatimu.pdf
- https://cdn.shopify.com/s/files/1/0445/4429/5076/files/pebozuxize.pdf
- https://cdn.shopify.com/s/files/1/0437/9515/3058/files/61414447620.pdf
- https://static.usrfiles.com/ugd/e2c6c1_3ca779249ce0403faf164f19dd494d2c.pdf
- https://static.usrfiles.com/ugd/b8c837_2dc492b0b03549709b0c968f3d0f165c.pdf
- https://static.usrfiles.com/ugd/4bb894_c84b024d5da146338eb6490fd2ececd2.pdf
- https://cdn.shopify.com/s/files/1/0432/8456/2084/files/video_call_recording_software.pdf
- https://cdn.shopify.com/s/files/1/0439/9906/8310/files/how_to_play_minecraft_multiplayer.pdf
- https://cdn.shopify.com/s/files/1/0431/7793/5004/files/campbell_biology_8th_edition.pdf
- https://cdn.shopify.com/s/files/1/0434/3129/7185/files/d_d_5e_blank_character_sheet.pdf
- https://cdn.shopify.com/s/files/1/0429/3951/5039/files/animal_camouflage_worksheets.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006df7.bin` `5cfaf8908e406a8021f98a7d7e1348f2d19a3ba5f78cfa22d99c99549aa3bac6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6DF7	5476 bytes
`font_01_sfnt_off00008094.bin` `ad0430e4a785f453e4a1d78929c9761e4e1944c0c5ef42c53c0bfae3023a30f5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8094	10108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.