PDF malware analysis — malicious · a70da3fe6cf135ef

MALICIOUS

PDF

44.3 KB Created: 2020-08-31 08:08:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c0bab1ebd0adfecbe69be58b876a6661 SHA-1: 06919c1109df905aa34d74420c87eb10db3fa224 SHA-256: a70da3fe6cf135eff2d8a90e14909f6cfc2c360137cd4521848e188941c51687

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm designed to redirect users to malicious infrastructure, specifically to `https://ttraff.cc/wix?keyword=note+taking+graphic+organizers+pdf`. The document body, though heavily obfuscated, contains references to the same URL and other benign-looking PDF links hosted on `static.usrfiles.com`. The ML classifier strongly indicates maliciousness, and the presence of a redirector link confirms the intent to lead the user to a harmful destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=note+taking+graphic+organizers+pdf
- https://static.usrfiles.com/ugd/0049ca_13eca986fe274c8a9d59f57a552d3e98.pdf
- https://static.usrfiles.com/ugd/ce0e6d_79571976b7fc4c54ac8c98b900a06cff.pdf
- https://static.usrfiles.com/ugd/7041e4_029501a9f93c469ba426671325f4cdd2.pdf
- https://static.usrfiles.com/ugd/79e5df_8ba808d014564ab98f37378b85d96c34.pdf
- https://static.usrfiles.com/ugd/913720_50b44ed15d914a7b8282993fdea3131d.pdf
- https://static.usrfiles.com/ugd/96768c_17f874786c5644ae9cf63de39604f899.pdf
- https://static.usrfiles.com/ugd/b8c837_e35fb9174f764b579e129f622a8f2444.pdf
- https://static.usrfiles.com/ugd/b8c837_31d8b11be27e4e3fba4150704e3391fa.pdf
- https://static.usrfiles.com/ugd/b8c837_da30d6ebb71e486ba35eac40279845ff.pdf
- https://static.usrfiles.com/ugd/b8c837_7afa9b45f7ed43809e9ab63c716396d9.pdf
- https://cdn.shopify.com/s/files/1/0440/7630/2486/files/antidiabeticos_orales_mecanismo_de_accion.pdf
- https://cdn.shopify.com/s/files/1/0432/4642/0136/files/14864804225.pdf
- https://cdn.shopify.com/s/files/1/0432/2823/3883/files/gta_kurtlar_vadisi_apk.pdf
- https://static.usrfiles.com/ugd/7e0eb0_6640ece62bf949bf8415f551004dbe61.pdf
- https://static.usrfiles.com/ugd/b8c837_6e47c7c7d1a6442d8ebdcdc9369fa4d1.pdf
- https://static.usrfiles.com/ugd/d902bb_fd9015ca710b418c9ea8b3d900d22d71.pdf
- https://static.usrfiles.com/ugd/d9d1f5_3b04d931ee01496799cfae5fe2292f17.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ef1.bin` `76506c33b9db643f5be86d64ed8560b671500be6acfdac97914fd35249e46414`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EF1	5468 bytes
`font_01_sfnt_off0000818f.bin` `abca0cdd22095ea1288fab9b85bfe9b09a0a3f48a8243c59623b02364b3d4ec5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x818F	10088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.