PDF malware analysis — malicious · 944abe00b3105acf

MALICIOUS

PDF

40.4 KB Created: 2020-08-29 04:59:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1537537118a6ba63d019c0f0d0bbd391 SHA-1: 487dddbf055ac027bb00d8ba3d4bc14a0e0665b2 SHA-256: 944abe00b3105acfc1b581133f34e7f130ebbc519c8879d400ed79f9b84de701

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link to a known malicious redirector, ttraff.cc, which is designed to lure users into downloading malicious content. The document body and embedded links suggest a social engineering attempt to trick users into believing they are downloading a legitimate driver. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=driver+for+brother+hl-+2270dw
- https://cdn.shopify.com/s/files/1/0432/3196/9438/files/xagobutano.pdf
- https://cdn.shopify.com/s/files/1/0430/6193/6285/files/nugubexar.pdf
- https://cdn.shopify.com/s/files/1/0440/8950/7990/files/spatial_statistics_textbook.pdf
- https://cdn.shopify.com/s/files/1/0433/4724/7263/files/swayamvara_parvathi_mantra.pdf
- https://cdn.shopify.com/s/files/1/0433/7182/3267/files/25548263784.pdf
- https://static.usrfiles.com/ugd/b8c837_f97fa90c669740a3bcc3e42ca525cfbf.pdf
- https://static.usrfiles.com/ugd/b8c837_c45e7602865345cea4cf140f4d1347eb.pdf
- https://cdn.shopify.com/s/files/1/0431/2589/9426/files/spivak_category_theory.pdf
- https://cdn.shopify.com/s/files/1/0430/2975/8103/files/92162973361.pdf
- https://static.usrfiles.com/ugd/b8c837_59eba415dd24402eadfa50bc7d0585f8.pdf
- https://static.usrfiles.com/ugd/b8c837_3c241bf2bd904e6089d9dccdb7324562.pdf
- https://static.usrfiles.com/ugd/b8c837_5d89034d119d48c48fec966aeb7b236a.pdf
- https://static.usrfiles.com/ugd/b8c837_f7378adc4b584a5d90ec85cc30d9aa8b.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006013.bin` `09de13cda41ce54d51466e4dc89987e4aaa5501dd9e75764ad853ef9c8b1e54c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6013	5284 bytes
`font_01_sfnt_off00007235.bin` `c44e282a969f8eda66b8a2b7233dfc4cff504a82fd0fd0fde9b7948fcd0083b6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7235	10252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.