PDF malware analysis — malicious · 9a85a28ba10572a3

MALICIOUS

PDF

45.5 KB Created: 2020-07-31 03:09:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: bf8aff4a4de73e3091dcbe6a2f946ced SHA-1: 746106e36d37156dabb826d7721031e6ded49c38 SHA-256: 9a85a28ba10572a3ad4ebbf0256071de7497359aea78bee205ba33f1098bb1aa

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, a technique often used to create SEO spam or to redirect users to malicious sites. One critical heuristic firing indicates a direct link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to 'Buffalo wild wings takeout menu pdf', suggesting a lure to disguise the malicious intent. The primary malicious URL identified is ttraff.cc, which is used in conjunction with a keyword that mimics a legitimate search query.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=buffalo+wild+wings+takeout+menu+pdf
- http://files.fountainoflifeministrieshavelock.org/uploads/1/3/1/8/131871816/bf10e1.pdf
- http://files.cherylmccormackdancers.com/uploads/1/3/1/1/131163898/rubidas.pdf
- http://files.jjenterpriseslcd.com/uploads/1/3/1/3/131383953/abdacc.pdf
- http://files.olbsfamilies.org/uploads/1/3/1/6/131606546/235ad8e3.pdf
- http://files.fountainoflifeministrieshavelock.org/
- https://cdn.shopify.com/s/files/1/0437/7303/4658/files/tanudaz.pdf
- https://cdn.shopify.com/s/files/1/0432/0935/9517/files/nirozonokot.pdf
- https://cdn.shopify.com/s/files/1/0437/9059/8305/files/80836117448.pdf
- https://cdn.shopify.com/s/files/1/0437/7555/7793/files/rifixexune.pdf
- https://cdn.shopify.com/s/files/1/0431/4185/7448/files/92745594302.pdf
- https://cdn.shopify.com/s/files/1/0433/6356/5718/files/guxujefosaguduvi.pdf
- https://cdn.shopify.com/s/files/1/0435/6544/9371/files/bufekadumegasumotos.pdf
- https://cdn.shopify.com/s/files/1/0437/7231/3751/files/49528532276.pdf
- https://cdn.shopify.com/s/files/1/0438/0111/6833/files/39847022450.pdf
- https://cdn.shopify.com/s/files/1/0432/9819/3573/files/3495954263.pdf
- https://cdn.shopify.com/s/files/1/0435/3510/6200/files/15126728593.pdf
- https://cdn.shopify.com/s/files/1/0432/2705/4237/files/12857707110.pdf
- https://cdn.shopify.com/s/files/1/0432/7948/3048/files/85781705537.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007630.bin` `d1b2127d079f7a5ddb4785f362ae81d1a954cef482310f529aa9096b36569aa7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7630	5352 bytes
`font_01_sfnt_off0000886e.bin` `8ee05bbd939ce237b3e93b5691b6a61e578a90a117c0a059f53a0f46e083f7cc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x886E	9528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.