PDF malware analysis — malicious · b1682011e4637081

MALICIOUS

PDF

48.7 KB Created: 2020-08-18 19:16:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 059ea0220e33b8e1c5a8db82259e24ae SHA-1: ac69eb6994f87284bca36677d9fad6376504c8b2 SHA-256: b1682011e46370816a2fcdcb5c830b517bee93e2608ce1eee45e949cb73431e9

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged as malicious by a machine learning classifier and contains a high number of external links, many pointing to a redirector. The document body contains a URL that appears to be part of a link farm designed to manipulate search engine results. The primary malicious URL identified is ttraff.ru, which is known to host redirectors.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=bangkok+phone+number+format
- http://files.faithlife.me/uploads/1/3/1/4/131437599/552806.pdf
- http://files.memojacq.com/uploads/1/3/0/9/130969695/4017825.pdf
- http://dexamog.autumnstewart.com/uploads/1/3/0/8/130874090/xusiwiv.pdf
- http://files.interfaithutica.org/uploads/1/3/0/7/130775393/fb660.pdf
- http://xasukiwi.athenastorm.org/uploads/1/3/1/4/131407440/najosagemizo_luvewo.pdf
- https://cdn.shopify.com/s/files/1/0432/9239/3640/files/wifuveb.pdf
- https://cdn.shopify.com/s/files/1/0435/8012/9441/files/24553172204.pdf
- https://cdn.shopify.com/s/files/1/0428/2292/6492/files/timula.pdf
- https://cdn.shopify.com/s/files/1/0431/7056/2209/files/holy_bible_amharic_free.pdf
- https://cdn.shopify.com/s/files/1/0430/8339/9321/files/24939459125.pdf
- https://cdn.shopify.com/s/files/1/0431/2127/9138/files/baghban_full_movie_hd_1080p_free.pdf
- https://cdn.shopify.com/s/files/1/0429/0412/5599/files/vojazipigavupudisajim.pdf
- https://cdn.shopify.com/s/files/1/0430/7707/5108/files/cardiovascular_system_quiz.pdf
- https://cdn.shopify.com/s/files/1/0429/6690/9081/files/habanera_carmen_sheet_music.pdf
- https://cdn.shopify.com/s/files/1/0451/3621/6229/files/genevoneditoxotoxemeka.pdf
- https://cdn.shopify.com/s/files/1/0427/8665/2316/files/sumojuguruzi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006729.bin` `a3d152ba1a2caff6d7f411f2c17bbc835b4b6e5c9abe78a106ed2740cfbf5229`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6729	5356 bytes
`font_01_sfnt_off0000792d.bin` `65e09293d74e37396d94bf0f65e0c5fc23af13a0ec49348fefba9e99e54cf881`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x792D	7364 bytes
`font_02_sfnt_off00008d43.bin` `c512f808cbd14f27ceccc5a3e019aec127d0ada43e529ca5b70d78e4d73858d5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8D43	12776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.