PDF malware analysis — malicious · 93cba12cd9e5f927

MALICIOUS

PDF

50.5 KB Created: 2020-07-30 08:21:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 99ccad1f3281f8b981aafa4fb26d85df SHA-1: 79394ce45e03275ec80a9f0cfbfa75895c04dfc9 SHA-256: 93cba12cd9e5f927c1c94acd0f7e827652d7a43d592355b7f719bc4274262d49

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, pointing to `https://ttraff.cc/pify?keyword=bharti+axa+elite+advantage+plan+brochure+pdf`. Additionally, it exhibits characteristics of a PDF link farm, with numerous links to external PDFs, many hosted on `cdn.shopify.com`. The document body, though heavily obfuscated, contains text related to a financial plan, suggesting a social engineering lure. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=bharti+axa+elite+advantage+plan+brochure+pdf
- http://files.outandaboutwithmskala.com/uploads/1/3/1/3/131398335/kixapuvan.pdf
- http://files.theatrere.co.uk/uploads/1/3/0/7/130740483/fovaximu.pdf
- http://files.nataliedownes.com/uploads/1/3/1/3/131380485/0ed4263c1e33a.pdf
- http://files.ajitourservices.com/uploads/1/3/0/7/130776255/bcb8d4b16b9.pdf
- http://files.birthassistanteducation.com/uploads/1/3/2/3/132302963/e73df516.pdf
- https://cdn.shopify.com/s/files/1/0427/9359/9132/files/22720262444.pdf
- https://cdn.shopify.com/s/files/1/0435/1298/7802/files/12637298410.pdf
- https://cdn.shopify.com/s/files/1/0433/9807/0426/files/vilukerodevotani.pdf
- https://cdn.shopify.com/s/files/1/0428/9665/4499/files/91370074708.pdf
- https://cdn.shopify.com/s/files/1/0428/6365/7119/files/22532343782.pdf
- https://cdn.shopify.com/s/files/1/0430/8631/5682/files/82215274126.pdf
- https://cdn.shopify.com/s/files/1/0435/2652/0986/files/babavab.pdf
- https://cdn.shopify.com/s/files/1/0435/5633/9871/files/xerujidifejenem.pdf
- https://cdn.shopify.com/s/files/1/0433/4541/2261/files/suketajiwir.pdf
- https://cdn.shopify.com/s/files/1/0429/7211/9193/files/ruxuwufotujix.pdf
- https://cdn.shopify.com/s/files/1/0440/0496/6565/files/lolumofanewalugopubobiw.pdf
- https://cdn.shopify.com/s/files/1/0427/8878/2236/files/sudonurajewafa.pdf
- https://cdn.shopify.com/s/files/1/0432/0450/9853/files/16882772848.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000085cb.bin` `93424e0b96282d7a840c80869be7c2f39ad51721d7073ae2b7128d93f488f925`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85CB	5436 bytes
`font_01_sfnt_off00009849.bin` `6b623b2c9e1295abb4dca6c1442f218e93057240eca4a21d8a456637deef3ef9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9849	10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.