PDF malware analysis — malicious · 9db4d270105d10a0

MALICIOUS

PDF

47.1 KB Created: 2020-09-07 14:55:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0339f12ec35eee17558e3d81523f5b54 SHA-1: 94c329562e6233a37bd06fa36b76e28b8f62f450 SHA-256: 9db4d270105d10a022cb15ea876f6664c2e88102e89e7210694267aa428da9b4

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a PDF link farm. One of these links, 'https://ttraff.cc/pify?keyword=budapest+travel+guide', is flagged as a known malicious redirector. The presence of this redirector, combined with the large number of external links, strongly suggests a malicious intent to lure users to harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=budapest+travel+guide
- https://static.usrfiles.com/ugd/b47706_7f5833d0093f4ea985ede12304f2149b.pdf
- https://static.usrfiles.com/ugd/c1108c_8ac873b5ee6644fcaa6afd175c1989f9.pdf
- https://static.usrfiles.com/ugd/78c764_eb3659bbaca84f0e8dd080e9838a2ecf.pdf
- https://static.usrfiles.com/ugd/16a96a_b0c40dd94146403888467b8b9a119091.pdf
- https://cdn.shopify.com/s/files/1/0434/7897/4626/files/modkit_for_vex.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/78476378890.pdf
- https://cdn.shopify.com/s/files/1/0436/6431/0425/files/19599864074.pdf
- https://cdn.shopify.com/s/files/1/0432/9547/3822/files/xaforiwesifalulasuta.pdf
- https://cdn.shopify.com/s/files/1/0433/3161/6923/files/xiwozo.pdf
- https://static.usrfiles.com/ugd/3225da_912a2a91a741463a9524db600865d3c1.pdf
- https://static.usrfiles.com/ugd/594ae5_d1de332cdb644cb59f789c478dd6a4b4.pdf
- https://static.usrfiles.com/ugd/0d2fda_a0bdd0c17b80487083745832e473b6ed.pdf
- https://static.usrfiles.com/ugd/d1d005_d84f0b3a78e24edc91cf5b75ce3c982d.pdf
- https://static.usrfiles.com/ugd/857e61_fc2dba59d48e4b46a40eaea0a4156375.pdf
- https://static.usrfiles.com/ugd/f3cb45_0b9388d52c974b1985fc5a2f5b45b2f5.pdf
- https://static.usrfiles.com/ugd/b8c837_fd7089a5519a467f9f8b13107eb7b74e.pdf
- https://static.usrfiles.com/ugd/345929_fbd02f1ec20f4827bfc28aea12cf3ee9.pdf
- https://static.usrfiles.com/ugd/eb4c03_fccd3159bbbf4a33ae0f9afc0f6cd3cb.pdf
- https://static.usrfiles.com/ugd/63022f_088f699a1130420e812157e1cddfce7a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000079d6.bin` `5bcf0411aed7d2ce0377e2750bf0089bdf2a905bb19779a7d11299d9bf073990`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79D6	5236 bytes
`font_01_sfnt_off00008bbc.bin` `c222daf9488a7aa6b6a5c5227e1754bdc334ea746f286a78566666dfabce6c6e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8BBC	10412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.