PDF malware analysis — malicious · 901b8654900876f0

MALICIOUS

PDF

51.2 KB Created: 2020-09-10 15:18:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c09a84ee61dd1e7a2c6ee36e8434adbc SHA-1: 067d5afbcc65ca390beb2d7eb623ba152fbf4518 SHA-256: 901b8654900876f07614f510411a8fd43eebbe7a2337027e15fc5fb34d0808d8

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link disguised as a vehicle manual. The link, https://ttraff.me/wix?keyword=chevy+trax+2015+manual, leads to known malicious infrastructure. The document also contains a large number of external PDF links, many pointing to static.usrfiles.com, suggesting a link farm or redirection strategy. The ML classifier strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=chevy+trax+2015+manual
- https://static.usrfiles.com/ugd/5de1df_9ffdb0216941443785f44b9f2ff390d2.pdf
- https://static.usrfiles.com/ugd/136d3d_bc98bf4ddccf410c9c44830df9cd6e2f.pdf
- https://static.usrfiles.com/ugd/afe78f_ad16e2a58e6e40afa2465bab40837451.pdf
- https://cdn.shopify.com/s/files/1/0432/3731/0626/files/safajararunokevavuk.pdf
- https://cdn.shopify.com/s/files/1/0434/7196/2265/files/46714049501.pdf
- https://cdn.shopify.com/s/files/1/0434/4433/8854/files/cambay_basin_geology.pdf
- https://cdn.shopify.com/s/files/1/0435/7881/8715/files/warhammer_40k_kill_team_arena.pdf
- https://cdn.shopify.com/s/files/1/0432/8154/7424/files/naked_warrior.pdf
- https://static.usrfiles.com/ugd/7e6083_48611085be3d4c22bc84204947484437.pdf
- https://static.usrfiles.com/ugd/46429b_ffb8b2493de94b7c9c194857150a409c.pdf
- https://static.usrfiles.com/ugd/f6a907_85b4d1e134094537a1c61a805b5d87d7.pdf
- https://static.usrfiles.com/ugd/585b1d_ec2e41e5557d4d5abc1d96c20bb0a786.pdf
- https://static.usrfiles.com/ugd/b8c837_62791ce8fa0e495aa54d24cf65722194.pdf
- https://static.usrfiles.com/ugd/3e9e83_1eb75e8938da4192ba918deb5f1cbde0.pdf
- https://static.usrfiles.com/ugd/665c20_b84c2fd357184095bf402ff0dc630fa4.pdf
- https://static.usrfiles.com/ugd/aef5b7_26292ddbec2c4ee2a2091631ffb37650.pdf
- https://static.usrfiles.com/ugd/144d27_9febf01d11624c388332ac5a473c27e5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000071c0.bin` `cceec62099639020e3289a75d2ba02cf3f2c44d2304647b8a278236304fd5503`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71C0	5172 bytes
`font_01_sfnt_off00008346.bin` `3ecefaa7040191988967ca5a71a27170663443e4559c4c8fc34c708154efbde5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8346	14856 bytes
`font_02_sfnt_off0000b179.bin` `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB179	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.