PDF malware analysis — malicious · a61ad27307f303dd

MALICIOUS

PDF

31.1 KB Created: 2020-09-10 10:48:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04

MD5: 79c3aef405e8d913b4317816dcd27b22 SHA-1: 7067a4e39461e8e39cf57c2c8d740803ea612739 SHA-256: a61ad27307f303dd6367573b877164018f3ad0d0375a46209118b7c9018568d8

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious due to a high number of embedded external links, many of which lead to a redirector service. This suggests a phishing or link-farming attack designed to lure users to malicious sites. The presence of a link to a redirector service, specifically 'https://ttraff.link/wix?keyword=basic+financial+accounting+and+reporting+book', is a primary indicator of this malicious intent. No scripts were extracted, but the structure and link farm indicate a likely attempt to distribute malicious content or lead users to phishing pages.

Machine Learning

Nyx PDF Classifier malicious score 0.9988

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=basic+financial+accounting+and+reporting+book In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://static.usrfiles.com/ugd/ce4b7c_4788fa4289e34972887b45cef4e52219.pdfIn PDF document text
- https://static.usrfiles.com/ugd/ca300b_e07f4b6a706540f3a27be34f6fe64950.pdfIn PDF document text
- https://static.usrfiles.com/ugd/9b7d8a_cf8dc2d8fd4a4b66aff957de91004b16.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/5930/4865/files/sigil_stone_skyrim.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/0792/4635/files/basic_mathematics_serge_lang.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/1313/5774/files/lagu_celine_tam_flashlight.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/6475/4325/files/73287279113.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/0274/9347/files/dress_pattern_book.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/2670/8640/files/assemble_gnrale_constitutive.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/9214/7366/files/jomevapabuwe.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/9421/1750/files/mehndi_design_photos.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6553/0785/files/97871021620.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/2007/4663/files/zizopizinete.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/7618/2426/files/fabunuzi.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006640.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6640	5576 bytes
SHA-256: `d5d85c6baafe4b544f32482a4340b46971a7316191dc43b3154b40583e153f4e`

Open this report in the interactive analyzer, or submit your own file for analysis.