PDF malware analysis — malicious · b63920dd9ffb22f2

MALICIOUS

PDF

43.3 KB Created: 2020-08-29 12:23:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: adc7a2f991b444c6fc960db55c1462d8 SHA-1: 56f8fa2b4297cc35ac4743681f487539eda29599 SHA-256: b63920dd9ffb22f21348b125059faae13bf018a380acec9c8f2558a4b92bf8bd

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link that points to ttraff.ru, likely intended to lead the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains the same search query as the malicious URL, suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded links to external PDFs, further supporting the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=brown+sugar+2010+full+movie
- https://static.usrfiles.com/ugd/b8c837_f5d37feffc15469badd09f3a45dd958d.pdf
- https://static.usrfiles.com/ugd/b8c837_dfaa338034b746f7a4c2e5beacc168d9.pdf
- https://static.usrfiles.com/ugd/b8c837_3e2cb3b5b63e4742ab0fab769c7a8d8c.pdf
- https://static.usrfiles.com/ugd/b8c837_3de6defa916340009a4b3df1d3be7db0.pdf
- https://static.usrfiles.com/ugd/b8c837_53563f3050d540fdbe3476f48b28e3ae.pdf
- https://static.usrfiles.com/ugd/b8c837_0f00cb263d2946a187232e735135053d.pdf
- https://static.usrfiles.com/ugd/b8c837_82e8055f5a22495692bf1ad55f98445c.pdf
- https://static.usrfiles.com/ugd/b8c837_623c16f8a7a44d1eaae6d3bf95a21b91.pdf
- https://cdn.shopify.com/s/files/1/0432/9596/5352/files/99743241206.pdf
- https://cdn.shopify.com/s/files/1/0431/5663/5816/files/fumofetafamerosijiginafu.pdf
- https://cdn.shopify.com/s/files/1/0431/4251/2797/files/41470059797.pdf
- https://static.usrfiles.com/ugd/b8c837_caba378897434a4e9a4c7be3dabc2fbf.pdf
- https://static.usrfiles.com/ugd/b8c837_290bc459e8dc47b8aea4d3692838abe0.pdf
- https://static.usrfiles.com/ugd/22739b_266ffad1dc5d4d58accd3102610ef740.pdf
- https://static.usrfiles.com/ugd/b8c837_550e1608d7534594aaa9e56f712f9d10.pdf
- https://static.usrfiles.com/ugd/b8c837_6566ae8361964e21a1ac8ad05b635757.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000051dc.bin` `8545f1eb941fc16a3228a8b8003dec6ec721d12cfb3c94d0abf2489b04c17bae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51DC	5616 bytes
`font_01_sfnt_off00006501.bin` `b91b2d6786cc3f7fd55481467042df58326ed4542f27726167b35a4462232caf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6501	10708 bytes
`font_02_sfnt_off00008986.bin` `9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8986	16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.