PDF malware analysis — malicious · a906e36642f3c03e

MALICIOUS

PDF

43.0 KB Created: 2020-08-31 07:44:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 01051cacfd1a186d4b1d543b4c4ed077 SHA-1: 6b1f21d4ca27d79d797d14216d20f459633550a5 SHA-256: a906e36642f3c03e6ec874c24462222c070a57965204c1bdd800f42b89d1871e

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a malicious redirector link disguised as a free printable weekly planner. The primary heuristic firing indicates that the PDF links to known malicious redirector infrastructure, specifically `https://ttraff.ru/wix?keyword=weekly+planner+printable+free+pdf`. This suggests the document is designed to lead users to a malicious site, likely for further exploitation or phishing. No scripts were extracted, and the document body is heavily obfuscated, but the presence of the malicious URL is a strong indicator of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=weekly+planner+printable+free+pdf
- https://static.usrfiles.com/ugd/158fb9_44ffc0d6abaa4a50be80807902cdc8b0.pdf
- https://static.usrfiles.com/ugd/c4ccc4_bfdb2454399f413a83148e4ee0210d01.pdf
- https://static.usrfiles.com/ugd/3aee12_85329fa9b80c4ee6b641555759f474d6.pdf
- https://static.usrfiles.com/ugd/49be48_bc408352ccc544268ea838e361f5ed30.pdf
- https://static.usrfiles.com/ugd/87d215_129ee690e94e413b98e2b09afe4a8e0b.pdf
- https://cdn.shopify.com/s/files/1/0433/0507/4838/files/edible_fungi.pdf
- https://cdn.shopify.com/s/files/1/0434/7360/0678/files/gilulefize.pdf
- https://static.usrfiles.com/ugd/b8c837_a0fd6ca95ad748b29772bbf24b52a278.pdf
- https://static.usrfiles.com/ugd/dfb5f8_c3a9fcea1ab74eaea1e1b79e2470bac0.pdf
- https://static.usrfiles.com/ugd/95089d_6e0a3a8c2dfb41188f0f620a6923ea5f.pdf
- https://static.usrfiles.com/ugd/b8c837_09019ddf907f4121ab5fd2c0154ea5a8.pdf
- https://static.usrfiles.com/ugd/c618e9_91228d98dc5a43bca6ceb561e313ca3c.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e03.bin` `cae20280de34ced3e5f0dd452e0bad5431efb0adf41118068a639fa4ab18a4f8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E03	4856 bytes
`font_01_sfnt_off00006e98.bin` `354e99aa35e9965432637883dd03705240c0293f31eb132c4f5d37f515843143`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E98	10180 bytes
`font_02_sfnt_off0000916e.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x916E	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.