PDF malware analysis — malicious · 9dd56a3f6540a864

MALICIOUS

PDF

110.7 KB Created: 2020-08-02 14:08:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9ab168e4b64b32b285f8c2b8da0a85a5 SHA-1: 81d59d184a41a6bdca8d6675526a5261acf9346f SHA-256: 9dd56a3f6540a8645602f5c97ac51b2c2aacf80c8f0634598cd73c0defa745e7

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. Additionally, it exhibits characteristics of a PDF link farm, with numerous links, many hosted on Shopify. The embedded URL 'https://ttraff.ru/pify?keyword=first+and+last+names' is the primary indicator of malicious intent, likely serving as a lure for further malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=first+and+last+names
- http://files.warriorheartedmom.org/uploads/1/3/0/9/130969358/6147161.pdf
- http://files.thelashqueenofregina.com/uploads/1/3/2/7/132740270/rosedevewasapemite.pdf
- http://files.kathleenhannigan.com/uploads/1/3/0/7/130776567/7142088.pdf
- https://cdn.shopify.com/s/files/1/0440/3894/6981/files/major_lazer_be_together.pdf
- https://cdn.shopify.com/s/files/1/0438/9660/2779/files/40115154493.pdf
- https://cdn.shopify.com/s/files/1/0430/5115/5618/files/ruzalin.pdf
- https://cdn.shopify.com/s/files/1/0438/5705/1808/files/danusoft_free_keylogger.pdf
- https://cdn.shopify.com/s/files/1/0432/5048/3368/files/bipuwose.pdf
- https://cdn.shopify.com/s/files/1/0428/8974/0441/files/linod.pdf
- https://cdn.shopify.com/s/files/1/0428/0628/0355/files/42314455630.pdf
- https://cdn.shopify.com/s/files/1/0431/1692/0996/files/feropinupud.pdf
- https://cdn.shopify.com/s/files/1/0430/6416/4506/files/47095475727.pdf
- https://cdn.shopify.com/s/files/1/0430/8919/9268/files/46060695490.pdf
- https://cdn.shopify.com/s/files/1/0431/3802/3586/files/76127451108.pdf
- https://cdn.shopify.com/s/files/1/0431/8475/0747/files/9117059590.pdf
- https://cdn.shopify.com/s/files/1/0432/6581/8789/files/associated_press_guide_to_news_writing.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00015b77.bin` `6080d181f0524c2f2753e794b19f5885547ffc18035e1024dfb9513e1650dde0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15B77	7536 bytes
`font_01_sfnt_off000174f3.bin` `99afd44e93531b2d4ae15c0a0800def790c46430f425f73c1174395f71e90878`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x174F3	4928 bytes
`font_02_sfnt_off0001859f.bin` `b0e4b2a84220c6510743793134a318f21f389ee135e78ff384c0add7929788c1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1859F	11568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.