PDF malware analysis — malicious · 9b66de046a395b3f

MALICIOUS

PDF

44.5 KB Created: 2020-09-06 08:30:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 064a8d8d183286c10caa755c9895374a SHA-1: c7af5dd28db12884b7eb4f99737e53fccf858aed SHA-256: 9b66de046a395b3fec022ee095c126fa27e8c90a339c96f3306811688380f4a8

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF document contains a malicious redirector link disguised as content related to a Bengali movie song. The PDF_MALICIOUS_REDIRECTOR_LINK heuristic confirms the presence of a link to known malicious infrastructure. The PDF_SEO_LINK_FARM heuristic indicates the document is part of a link farm, likely to improve search engine ranking for malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=bengali+movie+mejo+bou+song
- https://static.usrfiles.com/ugd/fd7405_1dc7f1f555bd4a4c836f3019ab0728d0.pdf
- https://static.usrfiles.com/ugd/89363e_c24cc60731274c3a8e2ed334c19dc747.pdf
- https://static.usrfiles.com/ugd/b8c837_50bac93e13434f238ddd3c695c04caea.pdf
- https://static.usrfiles.com/ugd/d775a9_f9acfdd3925b4c8393b3e30b33f00d22.pdf
- https://static.usrfiles.com/ugd/db93e9_22e069f008094eb8861324e0e39296ec.pdf
- https://static.usrfiles.com/ugd/8b4172_f92bf96bed744ec78d8e0dd3a935bcad.pdf
- https://static.usrfiles.com/ugd/917232_0e0c7fda7e8945dba153669c37568434.pdf
- https://static.usrfiles.com/ugd/6a7407_23f3f8401215417eaee1e031860ff2b2.pdf
- https://static.usrfiles.com/ugd/2a2e94_df6b9f8b934341e59bb53b87652d8b20.pdf
- https://cdn.shopify.com/s/files/1/0435/4077/5064/files/sirefi.pdf
- https://cdn.shopify.com/s/files/1/0429/9636/7511/files/human_physiology_female_reproductive_system.pdf
- https://cdn.shopify.com/s/files/1/0428/9714/6019/files/les_articles_definis_indefinis_et_partitifs_exercices.pdf
- https://static.usrfiles.com/ugd/bfbc46_8414d9965f66443f93f916bf235e886e.pdf
- https://static.usrfiles.com/ugd/430cb2_0a81b90df4a64316951bf276c2dbfb9e.pdf
- https://static.usrfiles.com/ugd/227d0f_f5ed7736740b4bc19d84464cdcac0258.pdf
- https://static.usrfiles.com/ugd/0a052f_2c8add5b4fec4370a166102dd7caf3bc.pdf
- https://static.usrfiles.com/ugd/359e64_60740419d88f459da354456e0b41517f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000068f0.bin` `753e0ce121f9c05f275d25ce295a028149f3be5878ea26dd1e3190cdc3337859`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x68F0	5236 bytes
`font_01_sfnt_off00007abd.bin` `1ad2d51e62239e34db4047c744f363fd9b7a010c9e7bdd1ede6ecb47c844a014`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7ABD	13448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.