PDF malware analysis — malicious · 9deac5fb1ec25b57

MALICIOUS

PDF

42.8 KB Created: 2020-08-06 20:44:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0303f68d8e24b9eec30ade493e5d6ee5 SHA-1: 6a91a8dcb5d63a953e468674a30e42c67ae03f2f SHA-256: 9deac5fb1ec25b5738bf7472852e1c9f083e6ff56501bdee4196c5d8bcdaed2a

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier and contains a critical heuristic indicating it links to known malicious redirector infrastructure. The document also exhibits characteristics of a PDF link farm, with numerous embedded links, many pointing to Shopify domains hosting other PDFs. The primary malicious URL identified is https://ttraff.ru/pify?keyword=capillary+refill+time+adalah+pdf, which is likely used to redirect users to further malicious content. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=capillary+refill+time+adalah+pdf
- http://files.potluckfoundation.com/uploads/1/3/1/3/131398145/2396f789.pdf
- http://files.abaautismservicescentralwest.com/uploads/1/3/1/4/131437311/januratibofapigazir.pdf
- http://files.logannti.com/uploads/1/3/1/3/131379252/1802888.pdf
- http://files.backwind.ca/uploads/1/3/1/3/131381411/paxisod.pdf
- http://files.familypracticecenterofnewtown.com/uploads/1/3/2/7/132740285/cf11513.pdf
- https://cdn.shopify.com/s/files/1/0431/6535/2095/files/tafilikinonebowuvevu.pdf
- https://cdn.shopify.com/s/files/1/0434/2104/0792/files/lagikisojip.pdf
- https://cdn.shopify.com/s/files/1/0429/8889/6415/files/wumilaxuto.pdf
- https://cdn.shopify.com/s/files/1/0436/8865/7051/files/39222993648.pdf
- https://cdn.shopify.com/s/files/1/0433/0212/5733/files/vetugileterupitofuxa.pdf
- https://cdn.shopify.com/s/files/1/0431/1633/1172/files/kinokaf.pdf
- https://cdn.shopify.com/s/files/1/0437/3191/0810/files/rexosekute.pdf
- https://cdn.shopify.com/s/files/1/0433/6094/4296/files/earth_science_lab_answer_keys.pdf
- https://cdn.shopify.com/s/files/1/0431/4251/2802/files/57260941803.pdf
- https://cdn.shopify.com/s/files/1/0432/9239/3640/files/art_of_electronics.pdf
- https://cdn.shopify.com/s/files/1/0436/7250/2425/files/vcarve_pro_tutorials.pdf
- https://cdn.shopify.com/s/files/1/0435/0862/9663/files/fake_phone_number_generator.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000069fe.bin` `b56f1b5f9c490a26d60372faf626b360755ce0884b7279ad96818415ab275b79`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69FE	5112 bytes
`font_01_sfnt_off00007b3c.bin` `9bb52dd8a53db8f0950cd47368005789cb43ef9248219d91c0c5d9a4368ceda9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B3C	10332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.