PDF malware analysis — malicious · ac751334c995e2b1

MALICIOUS

PDF

33.8 KB Created: 2020-09-12 01:55:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 06974aa1940d405b8e898dc79a13246b SHA-1: 070188c06c43a85cb477d5fc17ea6f59cafe5219 SHA-256: ac751334c995e2b19baa1e6cd73ae26c1dc32187db1fc7bfaf79d54546153edb

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=salaam+alaikum+song+free'. This URL is presented within the document body, disguised as a free song download. The PDF also exhibits characteristics of a link farm, with numerous external links, many pointing to 'static.usrfiles.com'. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=salaam+alaikum+song+free
- https://static.usrfiles.com/ugd/008e52_c1f6f6ba79434c1195635fd79e63afcc.pdf
- https://static.usrfiles.com/ugd/035627_6ed7de26d1fa45e2a8fb2193ef31085f.pdf
- https://static.usrfiles.com/ugd/0a052f_b3ec26568aab4e369c0041d5241ad6eb.pdf
- https://static.usrfiles.com/ugd/fdd6c2_4670f0c321ea4c9a869076fbda0913c0.pdf
- https://static.usrfiles.com/ugd/db93e9_c3399f2ef1f14d1390aa965877250fb4.pdf
- https://static.usrfiles.com/ugd/599026_94ea7ceb987d43e5bb018be7fb5b7e8e.pdf
- https://static.usrfiles.com/ugd/e481ce_00ef24b970914bed87ffc61141a75722.pdf
- https://static.usrfiles.com/ugd/8ff694_a62bb53e365045e4baf2343a1bff2c32.pdf
- https://cdn.shopify.com/s/files/1/0432/5736/4638/files/32478334979.pdf
- https://cdn.shopify.com/s/files/1/0429/9381/1619/files/85754134853.pdf
- https://cdn.shopify.com/s/files/1/0434/7245/3797/files/smallest_reader_for_android.pdf
- https://static.usrfiles.com/ugd/c63bf9_a1ae8e76fbbd46b983c8ea93cf12a7d9.pdf
- https://static.usrfiles.com/ugd/370ea2_a73712f8a789447997c8d952013a67fa.pdf
- https://static.usrfiles.com/ugd/b18e4d_db566327ed574faa9b53d86dc64a05f5.pdf
- https://static.usrfiles.com/ugd/850f07_1e58a8b6fdc24adc9cdd385db6cd73b8.pdf
- https://static.usrfiles.com/ugd/739437_586ea86c2d724aa882349757646263ce.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000047f6.bin` `d8f9941799fb3ee63db8f2e6317a165bc0f76f22284e9dc18d0f32974407c88d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x47F6	5256 bytes
`font_01_sfnt_off000059c3.bin` `869ecc299e5487174969ed9f608b3d2f256743f6b877e75da273671dc309b312`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x59C3	9616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.