PDF malware analysis — malicious · b10a6cd5a647bb90

MALICIOUS

PDF

50.8 KB Created: 2020-09-08 16:47:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c347d38210607667856989d04174f699 SHA-1: 130e2eecaad07d1531b1a34e07274d4a04e17861 SHA-256: b10a6cd5a647bb9018d79fc727fbc61143b025d32d734cc8c46f643bb537beae

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged as malicious due to a high number of embedded links pointing to a redirector infrastructure. The primary malicious URL identified is https://ttraff.me/wix?keyword=can+android+emulator+use+bluetooth, which is part of a link farm. This suggests the document's purpose is to lure users to malicious sites, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=can+android+emulator+use+bluetooth
- https://static.usrfiles.com/ugd/39cb9d_5d7a95e2223d465e964d6782e766b5fd.pdf
- https://static.usrfiles.com/ugd/07e02c_453ad08e242e492aae10b6e22b0a500e.pdf
- https://static.usrfiles.com/ugd/628a76_7328bc51b7f142dfb790702c33a03e56.pdf
- https://static.usrfiles.com/ugd/5b604d_12c84ec08d8c4ac7a9a5113ee53b702b.pdf
- https://cdn.shopify.com/s/files/1/0432/1184/9892/files/9966360842.pdf
- https://cdn.shopify.com/s/files/1/0430/1357/0709/files/30191333458.pdf
- https://cdn.shopify.com/s/files/1/0435/9038/5823/files/25553397374.pdf
- https://cdn.shopify.com/s/files/1/0432/5244/9435/files/lifowavosamutapariwul.pdf
- https://cdn.shopify.com/s/files/1/0429/4295/5676/files/velegegogasixafuga.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/nejoxalivivurotuzepebibus.pdf
- https://cdn.shopify.com/s/files/1/0432/6824/3624/files/78345204570.pdf
- https://static.usrfiles.com/ugd/c3f88d_ec32ca2295464d609866c9a1bd9dca06.pdf
- https://static.usrfiles.com/ugd/34e21e_f2578479af8b4e6485d56a20255e5b0b.pdf
- https://static.usrfiles.com/ugd/8aba0c_c32ff1fc2f1a4c6488f5b199f0cda7e7.pdf
- https://static.usrfiles.com/ugd/808cd0_5ba3962ad1cf423fa17031ddd43edcf3.pdf
- https://static.usrfiles.com/ugd/b8c837_4b36690e44f14102b07a6aeeb259cabf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007aeb.bin` `9b12e2110f800fb0523dcf37f32c79e50ec469860e7672046172e6b5a8ab9ec5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AEB	5108 bytes
`font_01_sfnt_off00008c12.bin` `f1f2f4d3e9b6e70015d4fff9fd769292d4fe25681c2d2315ee384874d85094e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C12	10328 bytes
`font_02_sfnt_off0000af68.bin` `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAF68	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.