PDF malware analysis — malicious · b09dc52e33844aa9

MALICIOUS

PDF

44.6 KB Created: 2020-08-08 05:03:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9b97020bc25540bbb14e5720610d8b91 SHA-1: d0410c23be8d99589180456baf278a3d585c7a97 SHA-256: b09dc52e33844aa926df891a251def7d41629b22e21328d60dbb44e30eaefda6

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document functions as a link farm, embedding numerous URLs disguised as 'tattoo aftercare instructions'. The primary malicious URL, https://ttraff.ru/pify?keyword=tattoo+aftercare+instructions+sheet+pdf, is identified as a redirector to malicious infrastructure. The document's structure and the high number of outbound links strongly suggest a phishing or redirection attempt to compromise users.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=tattoo+aftercare+instructions+sheet+pdf
- http://files.oradesignsohio.com/uploads/1/3/1/3/131380005/bebanekowiloza.pdf
- http://files.allthingsdunham.com/uploads/1/3/0/7/130739510/5015553.pdf
- http://files.vca1988.org/uploads/1/3/1/6/131637016/zesegisuzojibiguna.pdf
- https://cdn.shopify.com/s/files/1/0427/7708/4070/files/fikajilab.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dijev.pdf
- https://cdn.shopify.com/s/files/1/0428/2961/1171/files/43235625449.pdf
- https://cdn.shopify.com/s/files/1/0431/6538/4861/files/47230312199.pdf
- https://cdn.shopify.com/s/files/1/0439/6027/1006/files/blueprints_obgyn.pdf
- https://cdn.shopify.com/s/files/1/0431/3061/8011/files/63851831689.pdf
- https://cdn.shopify.com/s/files/1/0438/3073/9106/files/lomiximo.pdf
- https://cdn.shopify.com/s/files/1/0449/0720/0667/files/electronics_projects_for_engineering_students.pdf
- https://cdn.shopify.com/s/files/1/0431/9117/3282/files/34531298420.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fuwakuda.pdf
- https://cdn.shopify.com/s/files/1/0433/8450/4474/files/wikir.pdf
- https://cdn.shopify.com/s/files/1/0429/0910/6335/files/43145406791.pdf
- https://cdn.shopify.com/s/files/1/0433/3086/3259/files/17563804437.pdf
- https://cdn.shopify.com/s/files/1/0432/8259/6000/files/vubetibakojemowixesoxokor.pdf
- https://cdn.shopify.com/s/files/1/0434/7366/6213/files/98230081681.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000071e5.bin` `e8ebb1bc5fc733afcaf9ef46f84d6a5ef0f0b3bd10186a0372e7ac5e429f3ab1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71E5	5160 bytes
`font_01_sfnt_off00008370.bin` `927da9454ad619c4086a05d393603aa133f268317b0f093b9e64a4678b417f50`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8370	9876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.