PDF malware analysis — malicious · 907eb3454484b3b7

MALICIOUS

PDF

40.0 KB Created: 2020-09-07 15:43:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: dde2660fdcf527a72d8de2f677ba524b SHA-1: a99654d5525098e9c270a585e2f2f41833c1a134 SHA-256: 907eb3454484b3b7981874bdf8034c619fe997abacc4a99220cc4dd2da98c5e7

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link to a malicious redirector, ttraff.me, disguised as a Carbatec thicknesser manual. The document also functions as a link farm, pointing to numerous PDFs hosted on static.usrfiles.com, likely for SEO manipulation or to spread traffic. No scripts were extracted, but the presence of a malicious redirector and the link farm structure strongly indicate a phishing or malicious redirection attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=carbatec+15+inch+thicknesser+manual
- https://static.usrfiles.com/ugd/140efa_28baab8750e24c00b17797007450ebfb.pdf
- https://static.usrfiles.com/ugd/55cc32_1f55afe947c84dfb963a18e75497008d.pdf
- https://static.usrfiles.com/ugd/b8c837_9800b51d04f245bdb5d3dc1c43cfac2a.pdf
- https://static.usrfiles.com/ugd/a48928_eec7169bac1c4ccbb967d32b80bb78dc.pdf
- https://static.usrfiles.com/ugd/6f53d7_af2e152bd7c24d249cf253304abcf1ae.pdf
- https://static.usrfiles.com/ugd/d1fcfc_db5813acabd540d096935ff72222affc.pdf
- https://static.usrfiles.com/ugd/6f9b04_eb20d8c9d94341aa85ddfec7166f01c0.pdf
- https://static.usrfiles.com/ugd/c068f8_94500a50528e48138118106beb632552.pdf
- https://static.usrfiles.com/ugd/b444d4_c1f6ca0285354c7dbf4f1c92f6ddfb0d.pdf
- https://static.usrfiles.com/ugd/ea9bdf_face27ef951b4020b6c49a1948f5ed70.pdf
- https://static.usrfiles.com/ugd/c3f59f_447e08b8538d457185d69e7c34808d95.pdf
- https://cdn.shopify.com/s/files/1/0435/6577/7059/files/os_x_10._10.pdf
- https://cdn.shopify.com/s/files/1/0428/8000/8355/files/nonagud.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e2b.bin` `e68acdc70cb52651fc3c6bef48fb07690040519d68f06f5f5f2f843ad237184c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E2B	5324 bytes
`font_01_sfnt_off00007022.bin` `9c730a15e73fbb1e2bfeb26c8f6cb13eb582b2e6548cf23ef86af19ce23bd44b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7022	10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.