PDF malware analysis — malicious · b389594e88cb07fe

MALICIOUS

PDF

51.3 KB Created: 2020-08-30 01:19:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 069ebe1689ddb3c75871033df60da16f SHA-1: f4fa8f9fdef245e3288026d00374e461795c7985 SHA-256: b389594e88cb07feff345eb24a7960c7640f8f1f1bb8ec63631f01a0647995e6

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains text related to 'Marlin. 45- 70 guide gun' and the malicious URL, suggesting a lure. The PDF also contains a large number of external links, many pointing to 'static.usrfiles.com', which is flagged as a link farm. The primary malicious IOC is the redirector URL.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=marlin.+45-+70+guide+gun
- https://static.usrfiles.com/ugd/33a16d_638f5546634d409397afb97f5affd439.pdf
- https://static.usrfiles.com/ugd/ce0e6d_fbb9af86caf14bcd879f0d1e0dc18a66.pdf
- https://static.usrfiles.com/ugd/9c0842_063f519fa6ec4f9bb66593d83a8118d5.pdf
- https://static.usrfiles.com/ugd/07625c_7f12a0528c6b41f5b1e421b38768230a.pdf
- https://static.usrfiles.com/ugd/b8c837_abb20bad16374a96ba6a072e9a25c470.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/fisebupujavilugux.pdf
- https://cdn.shopify.com/s/files/1/0435/8642/0893/files/electrical_standard_cable_selection_chart_for_motors.pdf
- https://cdn.shopify.com/s/files/1/0430/5007/4269/files/65086029679.pdf
- https://cdn.shopify.com/s/files/1/0432/4907/4336/files/gamibubivezujagusobeni.pdf
- https://cdn.shopify.com/s/files/1/0428/2384/3996/files/factoring_trinomials_worksheet_answers_kuta_software.pdf
- https://cdn.shopify.com/s/files/1/0438/8818/1400/files/51626568997.pdf
- https://static.usrfiles.com/ugd/21e6f2_687561ba519147a293cdfa1d149969c1.pdf
- https://static.usrfiles.com/ugd/07625c_34236f0071bd48e2a6a87f22ed13eaaf.pdf
- https://static.usrfiles.com/ugd/b8c837_368b52a6506f474486ead39902221bed.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007dab.bin` `c8a77cf2b7e160da53068301609616b5e276a085b1dec140cd228982a33b202d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7DAB	5012 bytes
`font_01_sfnt_off00008ec6.bin` `7c73cf152447c7f5978d6c19e4228284e8a6152227d76521be6c2f1e52a3aefb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8EC6	10420 bytes
`font_02_sfnt_off0000b269.bin` `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB269	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.