PDF malware analysis — malicious · 962ba66c88d3e75a

MALICIOUS

PDF

37.0 KB Created: 2020-08-30 00:55:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 04b3852f8c36f567a69231e2341acf29 SHA-1: a37efc2d8d190d914fed1a4e0ff6be5587f82d01 SHA-256: 962ba66c88d3e75a6b80e6352ec8d9ccc4ea4a2e0fb7d586877658679251f30b

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, a technique often used in SEO link farms to manipulate search engine rankings or to distribute malicious content. One of the primary links points to a known malicious redirector at 'ttraff.ru'. The document body appears to be garbled, but the presence of the URL suggests a lure. The ML classifier strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=ziggy+marley+beach+in+hawai
- https://static.usrfiles.com/ugd/0a052f_604cd0335ee14e76875060452de7c4b3.pdf
- https://static.usrfiles.com/ugd/80c1db_95f56242f5d34753b65aca896f6f5bca.pdf
- https://static.usrfiles.com/ugd/6846fe_6e0a12f647004eeeb45521568d32d23b.pdf
- https://static.usrfiles.com/ugd/856cea_1df2a1b8a7414b209183a51489e94128.pdf
- https://static.usrfiles.com/ugd/b8c837_b2bdaabe6eac49cabe9427dcaf520c74.pdf
- https://static.usrfiles.com/ugd/b8c837_37d2deb748e544a0a45f5295f2ad0007.pdf
- https://static.usrfiles.com/ugd/b8c837_22a277fea62c494f8fa2f190366ff8c7.pdf
- https://static.usrfiles.com/ugd/7baf93_44e87a5d41d24d0bb8ee6e9ec830f301.pdf
- https://static.usrfiles.com/ugd/c836c3_cc7943a9cfb74b9c82afa11b16f3370a.pdf
- https://cdn.shopify.com/s/files/1/0428/1312/8863/files/biology_practical_class_12.pdf
- https://cdn.shopify.com/s/files/1/0431/4906/6397/files/xugupisalugoruxazatesem.pdf
- https://cdn.shopify.com/s/files/1/0445/5153/6799/files/cervicofacial_lymphadenopathy.pdf
- https://cdn.shopify.com/s/files/1/0437/2014/7093/files/aieee_2020_online_exam_question_paper_with_solution.pdf
- https://cdn.shopify.com/s/files/1/0461/7486/3513/files/army_police_background_check_form.pdf
- https://cdn.shopify.com/s/files/1/0433/0346/9221/files/573039036.pdf
- https://cdn.shopify.com/s/files/1/0428/5336/7975/files/fedowidadeviw.pdf
- https://cdn.shopify.com/s/files/1/0463/1232/5285/files/bpc_full_form_in_medical.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000052f4.bin` `0b9fb0c205abf1dd006d8161f92678e506ea89f9ac7fe4900e696aad209ffa8b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x52F4	5328 bytes
`font_01_sfnt_off00006507.bin` `752af8956b7d701d4794705b5824a51ffc8a2d0e4f022b827578cde0e35894b1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6507	9920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.