PDF malware analysis — malicious · bbfb6af0dd9cbb92

MALICIOUS

PDF

47.1 KB Created: 2020-09-03 03:39:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 997ad725e50d3cae5a8ad84ecbe33931 SHA-1: 0289f0faea56a2a3210d7d77629e9fed5dad030f SHA-256: bbfb6af0dd9cbb92d452f9b8ecf36568b483c834c98e318431ebc03e36e648f9

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link disguised as sheet music, aiming to lure users to a malicious URL. The document body, though heavily obfuscated, contains the malicious URL and numerous other PDF links, suggesting a link farm or redirection strategy. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=nigerian+worship+songs+sheet+music
- https://static.usrfiles.com/ugd/5e8de6_67363cac77604e81b800d056d29f7b6b.pdf
- https://static.usrfiles.com/ugd/daca0d_4b63df7795db4e0483af61d12b027b0f.pdf
- https://static.usrfiles.com/ugd/f96b02_4112d700c6f0450d84ee2c4115290067.pdf
- https://static.usrfiles.com/ugd/9ea9b6_8beef3f51ae2411cbb44d68e2b3b5000.pdf
- https://static.usrfiles.com/ugd/f09a9d_0ae2f91697764384bb5388d81fe69ebf.pdf
- https://cdn.shopify.com/s/files/1/0438/0708/0608/files/32641781876.pdf
- https://cdn.shopify.com/s/files/1/0432/3953/8851/files/69450113410.pdf
- https://static.usrfiles.com/ugd/4c3d6a_140ca3d95b314060b8fd91572d0b0535.pdf
- https://static.usrfiles.com/ugd/06497e_9e2aec37fe0f47b29a908be089682cf6.pdf
- https://static.usrfiles.com/ugd/b8c837_3849cf880a9d411e869eb4303ccdca74.pdf
- https://static.usrfiles.com/ugd/aef5b7_7a4fcd54686b45c8b3aeeac145173309.pdf
- https://cdn.shopify.com/s/files/1/0433/2729/1544/files/gelikebaxeli.pdf
- https://cdn.shopify.com/s/files/1/0435/1868/9434/files/ebara_absorption_chiller.pdf
- https://cdn.shopify.com/s/files/1/0445/4989/8399/files/haemolytic_disease_of_the_newborn.pdf
- https://cdn.shopify.com/s/files/1/0431/5008/2202/files/73239193942.pdf
- https://cdn.shopify.com/s/files/1/0428/9226/3583/files/zusifoxunuf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000062af.bin` `8ac1e27a89387414e85620175e5847ec4a5881e33d373565974ad43a120031de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62AF	5260 bytes
`font_01_sfnt_off0000747a.bin` `191b3ac7230dbd469f80fddcf97941e97c9c6a1b0f4847604079e91bdf682856`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x747A	14312 bytes
`font_02_sfnt_off0000a15c.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA15C	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.