PDF malware analysis — malicious · a2e9308d66b4d0d6

MALICIOUS

PDF

42.3 KB Created: 2020-08-31 14:11:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: bcea7d37cb896bfe4f42c1679463f1dd SHA-1: 6a39cfea67bd7e6576f6a7193b093ba07180e3a1 SHA-256: a2e9308d66b4d0d6196631554185d108d86bb9e965fdb49387390e7ce89c0698

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains numerous links, including one pointing to a known malicious redirector at 'ttraff.cc'. This redirector is used in conjunction with a lure related to sprint retrospective templates, suggesting a phishing or social engineering attempt. The presence of a link farm and the ML classifier's high confidence further support the malicious nature of this document.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=sprint+retrospective+template+excel In PDF document text
- https://cdn.shopify.com/s/files/1/0431/8652/0224/files/fopirerelojeworuw.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0451/0603/6899/files/blank_july_2019_calendar.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/2484/2906/files/94931971234.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/6656/4520/files/dugiro.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_e28f30ce82144481a06ca84e8cbf376e.pdfIn PDF document text
- https://static.usrfiles.com/ugd/9d869b_62af5183612a40f797556304778d1644.pdfIn PDF document text
- https://static.usrfiles.com/ugd/ba3095_e75a11faf6ad448ba932405dee69b1df.pdfIn PDF document text
- https://static.usrfiles.com/ugd/ade4e6_2087a48d06424604865e6917838bfb90.pdfIn PDF document text
- https://static.usrfiles.com/ugd/4c1554_cec1d686d89343689438d7c55b1ea86c.pdfIn PDF document text
- https://static.usrfiles.com/ugd/4bdc6d_ea70020518fa4a54a0f6db885e856143.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_06f4b874ea354103be66a26c2c57c641.pdfIn PDF document text
- https://static.usrfiles.com/ugd/63d3ad_e1c6221bfe3241799e3f96fbbf74d077.pdfIn PDF document text
- https://static.usrfiles.com/ugd/834936_43f0b54168e04a598ab2aac80fac114a.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006784.bin` `07aecdf76ea177ca53ba2d374e29785ce369cd054bbee1d1ba0314aaaf173cdb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6784	5308 bytes
`font_01_sfnt_off00007988.bin` `4628d4c0a826ba51eabebbdb55a403253337fbd9f23dbc39ea69626eb9bd874c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7988	10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.