PDF malware analysis — malicious · a1bfce7b1567f0f9

MALICIOUS

PDF

46.7 KB Created: 2020-08-31 14:57:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 975b494fbf35bf08d17e5525971a0280 SHA-1: b5f3921176935593fa8ab9102c602d0e1aeaf5ac SHA-256: a1bfce7b1567f0f9ae931e4fd65511091daab76e7d8033f4fa37ce62c0da3a9b

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged as malicious by a machine learning classifier and contains a link farm of numerous external PDF files. One of these links, https://ttraff.cc/wix?keyword=a5+2017+android+9, redirects to known malicious infrastructure, indicating a likely phishing or malware distribution attempt. The document body contains garbled text but includes the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=a5+2017+android+9
- https://static.usrfiles.com/ugd/2f7815_03ecf507c06246358083a89eb5d729d6.pdf
- https://static.usrfiles.com/ugd/de3d83_a00f8a2e406f4737a640bb432e4b7ee9.pdf
- https://static.usrfiles.com/ugd/921909_093f1237c6f9450c839a07b998176a66.pdf
- https://static.usrfiles.com/ugd/5e81b9_4d5c733c6c2449f8ab51d7982e083e16.pdf
- https://cdn.shopify.com/s/files/1/0429/2047/6828/files/zifaledebuf.pdf
- https://cdn.shopify.com/s/files/1/0441/3777/5256/files/soil_buffering_capacity.pdf
- https://cdn.shopify.com/s/files/1/0431/2766/8890/files/fuvobifodupad.pdf
- https://cdn.shopify.com/s/files/1/0440/1725/4558/files/jusikadu.pdf
- https://cdn.shopify.com/s/files/1/0438/9886/3784/files/chemical_properties_of_alkali_metals.pdf
- https://cdn.shopify.com/s/files/1/0429/9672/7962/files/foxogog.pdf
- https://cdn.shopify.com/s/files/1/0430/9241/0525/files/92739362865.pdf
- https://static.usrfiles.com/ugd/6116da_a070d53b568a4d9e88bc065d906f0d46.pdf
- https://static.usrfiles.com/ugd/b8c837_cf674706d11f43ea869427b2b2bc124f.pdf
- https://static.usrfiles.com/ugd/0ebc1f_6a01b5a03b8146e88678dd83737a3f1f.pdf
- https://static.usrfiles.com/ugd/078c79_c086d73f13264b51bb85be141a0cd6cc.pdf
- https://static.usrfiles.com/ugd/e2c6c1_58bfdc4823da4356a3155f721ff25a3d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006278.bin` `22b9ed814cac232fd2bf1463f650b092c7e65a950ccecb17cbb246f5288f5bc1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6278	4872 bytes
`font_01_sfnt_off00007304.bin` `46e434621580e2901f8daf2aa569b862dab0090a1a0679aaef39eb77f53ba188`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7304	14204 bytes
`font_02_sfnt_off0000a013.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA013	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.