PDF malware analysis — malicious · 9922f797a285d1f5

MALICIOUS

PDF

67.5 KB Created: 2020-08-29 21:50:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9e55ece6b59df259b9c553a3a1567c41 SHA-1: 68728acb590cfdeb839198dc67b1cd74f467fa29 SHA-256: 9922f797a285d1f5c329f6e08154a44f08cdba3eb507526ce8c57d974a52663c

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file exhibits characteristics of a link farm, containing numerous embedded links to external PDF documents. One of these links, 'https://ttraff.club/wix?keyword=toyota+production+system+by+taiichi', is flagged as a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body contains garbled text but includes the same suspicious URL and a list of other PDF links, suggesting a coordinated effort to manipulate search engine results or distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=toyota+production+system+by+taiichi
- https://static.usrfiles.com/ugd/b8c837_3817d52ff11649bc92c5abae18723297.pdf
- https://static.usrfiles.com/ugd/b8c837_6978288d82fa4dec97c2966f9736cd85.pdf
- https://static.usrfiles.com/ugd/b8c837_c4cda6bd2d794ff4a1f776d213aa55d9.pdf
- https://static.usrfiles.com/ugd/63022f_06483f452b6a4491970983d9e7292fbe.pdf
- https://static.usrfiles.com/ugd/b8c837_becb0226ab7e4071bde5f85573797eb2.pdf
- https://static.usrfiles.com/ugd/b8c837_0ed2ea15a0cd4167ab7d6c4bb16740d8.pdf
- https://static.usrfiles.com/ugd/b8c837_ff72808bf56a467499be93704337857a.pdf
- https://static.usrfiles.com/ugd/b8c837_2a168aa21abb4672b0bcdeffe4bc379d.pdf
- https://static.usrfiles.com/ugd/b8c837_8e1b253cbb1f4a0d8a0cbfac212b163b.pdf
- https://static.usrfiles.com/ugd/f515ca_50e265271cd84741b84447e3307c0b10.pdf
- https://static.usrfiles.com/ugd/b8c837_c6c43a1de9d949f5ad10a1b366588b14.pdf
- https://static.usrfiles.com/ugd/b8c837_c732d686cbc34e9193386bd6b405652c.pdf
- https://static.usrfiles.com/ugd/b8c837_258dbef9c76f40558bbbdbc32dbe1360.pdf
- https://static.usrfiles.com/ugd/b8c837_166c583fa7264da5955d4ece513af4a4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008a59.bin` `0f630c964eab7cd2dc461dd7d3e4c2ef2e6d99c5d836df7a57c5e3e3f29cff56`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A59	17844 bytes
`font_01_sfnt_off0000c2bc.bin` `444338cb90dda9f8e1cf5074a30b190aa52e05a5c7002c08b137053708aaf741`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC2BC	5472 bytes
`font_02_sfnt_off0000d523.bin` `90e988ac35538bd94dff07b15c4d2c2369c33002e0f7de242cb76a09c6ed6dfb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD523	13856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.