PDF malware analysis — malicious · bb70024e227ba343

MALICIOUS

PDF

121.7 KB Created: 2020-08-30 18:31:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b56c7f7f6b830084245a4060707815c9 SHA-1: e82af413e61c9ba2a961b1efbd8b8890e220f390 SHA-256: bb70024e227ba34348a348f2d0d439ce13814e64e083c84e64d04adef00eb213

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a malicious redirector link, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The embedded URL, https://ttraff.ru/wix?keyword=a+comprehensive+grammar+of+the+engli, is the primary indicator of malicious intent. Additionally, the PDF exhibits characteristics of a link farm, with numerous embedded links pointing to external resources, as flagged by PDF_SEO_LINK_FARM. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=a+comprehensive+grammar+of+the+engli
- https://static.usrfiles.com/ugd/b8c837_1dfe8f8888b8491f80ea938412e789d6.pdf
- https://static.usrfiles.com/ugd/b8c837_1feed5ea865f4a4fbc5b698041eedfcc.pdf
- https://static.usrfiles.com/ugd/b8c837_4c69bdd5ea6641f28ed114ab42664ee6.pdf
- https://static.usrfiles.com/ugd/913720_d61384fce0994b75a30865ec403b79a9.pdf
- https://static.usrfiles.com/ugd/12745a_5b5d8af7aaf34744b016531fce26ea03.pdf
- https://static.usrfiles.com/ugd/d9d1f5_793b0e9e65be492ebc382bba56e1f0b4.pdf
- https://static.usrfiles.com/ugd/ac51ce_14f81b6b451e4524a84f3d407dfe3275.pdf
- https://static.usrfiles.com/ugd/b8c837_89dbc283b57b4d5cac7e2b0aff9cfc67.pdf
- https://static.usrfiles.com/ugd/b8c837_8181ecf9b67a4778851c6014f020d734.pdf
- https://static.usrfiles.com/ugd/b28561_5e09688b872d488b9eb033c504739d5c.pdf
- https://cdn.shopify.com/s/files/1/0428/3318/2886/files/52974508251.pdf
- https://cdn.shopify.com/s/files/1/0436/9691/4586/files/39960371745.pdf
- https://cdn.shopify.com/s/files/1/0433/2329/3864/files/basic_electrocardiography.pdf
- https://cdn.shopify.com/s/files/1/0437/9151/5805/files/37098766740.pdf
- https://cdn.shopify.com/s/files/1/0430/4273/4229/files/kirurilopawab.pdf
- https://cdn.shopify.com/s/files/1/0431/0273/2448/files/university_calculus_elements_with_early_transcendentals.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00019787.bin` `efd8c4c452879a11d75cac6871271ce5df0cf65105f6af94ad04c5d347b4d739`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x19787	5476 bytes
`font_01_sfnt_off0001aa09.bin` `1fc2a5202a5780ca54433c1036a7e04d5efc3eedc40275b20d17cc45f212c28b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1AA09	15312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.