PDF malware analysis — malicious · 8ef5ada6cbb536bc

MALICIOUS

PDF

60.9 KB Created: 2020-08-17 15:07:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 058af9fc216b8c31d90e09a3c4ba55f4 SHA-1: 5509a1f343a3deee7568ab8007f604e2210a0962 SHA-256: 8ef5ada6cbb536bcd30328a15572883b321f908b3ce3d402fab8f6b4675a5595

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains text related to 'free font' and the malicious URL. The primary attack vector appears to be a social engineering lure to trick users into clicking the malicious link, which leads to the ttraff.ru redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=bleeding+cowboy+font+free
- http://files.spmarketplace.com/uploads/1/3/2/7/132711954/mewalivatem.pdf
- http://files.tasharamitchell.com/uploads/1/3/0/7/130775641/23b63a.pdf
- http://files.hbmhopkinsbarnesandmoye.org/uploads/1/3/1/8/131856392/fegasenafukoz.pdf
- https://cdn.shopify.com/s/files/1/0431/7465/8197/files/xilufinirunowig.pdf
- https://cdn.shopify.com/s/files/1/0452/1240/1815/files/dupisutolefinozeloxi.pdf
- https://cdn.shopify.com/s/files/1/0434/1003/0748/files/macintosh_error_code_36.pdf
- https://cdn.shopify.com/s/files/1/0440/0129/6534/files/combiner_deux_fichiers_mac.pdf
- https://cdn.shopify.com/s/files/1/0432/2541/5843/files/1_hunnid_k_camp_download.pdf
- https://cdn.shopify.com/s/files/1/0440/5932/8662/files/pajexo.pdf
- https://cdn.shopify.com/s/files/1/0427/8360/4903/files/acm_icpc_problems_solutions.pdf
- https://cdn.shopify.com/s/files/1/0432/9930/7673/files/werewolf_online_apk_mod_2019.pdf
- https://cdn.shopify.com/s/files/1/0435/6934/8763/files/89756789046.pdf
- https://cdn.shopify.com/s/files/1/0439/9860/9566/files/womegadijev.pdf
- https://cdn.shopify.com/s/files/1/0429/5393/2966/files/karopofevujuvopozunolum.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005469.bin` `3ec30f38d5f7a130d14d16cc26a1bc7b1354dabc5b58cffc90d1f48fe3ce41a4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5469	1768 bytes
`font_01_sfnt_off00005d1e.bin` `570e2c1872c67b9f883f872de3161a674d9973455d1ed3d810cd4238045b9c2a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D1E	5184 bytes
`font_02_sfnt_off00006ee4.bin` `ec0c9b3f6d68a25e0b02d445a2b8d16dd9f6f3f215801dc948bae5df01f5a28e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EE4	39464 bytes
`font_03_sfnt_off0000d11a.bin` `47c030d9228c0fa7de47a04a3235ac4399d58f946d004f14f2437c253910024c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD11A	16504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.