PDF malware analysis — malicious · bd12d965e2fd5a85

MALICIOUS

PDF

45.0 KB Created: 2020-08-07 18:06:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: bb4f66d7733f34bc1fc138771a1a7dd6 SHA-1: ac51500bcd7872a77dab10011dececff7bfc93b8 SHA-256: bd12d965e2fd5a85a4691829065050ec4753e01c91ce1e064602a2d12a14446c

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link directs to a known malicious redirector at ttraff.com. The document body, though heavily obfuscated, contains the URL that leads to the malicious redirector, suggesting a lure to a phishing or malware distribution site. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=arduino+due+pinout+diagram+pdf
- http://files.totalityauthenticlife.com/uploads/1/3/1/4/131483153/biwisilarule.pdf
- http://files.bayareanaturalbirth.com/uploads/1/3/1/8/131856743/8245661.pdf
- http://files.thefashionablecrafter.com/uploads/1/3/1/0/131070151/1363715.pdf
- http://files.lethbridgeelectrical.com/uploads/1/3/2/6/132681062/1884aaf3639b7.pdf
- https://cdn.shopify.com/s/files/1/0431/1708/4839/files/taxivepokilaril.pdf
- https://cdn.shopify.com/s/files/1/0432/8390/6724/files/lizenifur.pdf
- https://cdn.shopify.com/s/files/1/0435/1816/5146/files/refrigeration_and_air_conditioning_technology_lab_manual.pdf
- https://cdn.shopify.com/s/files/1/0441/3915/1512/files/sapafikuzuruladam.pdf
- https://cdn.shopify.com/s/files/1/0431/0165/1105/files/pool_exercises_for_lower_back_pain.pdf
- https://cdn.shopify.com/s/files/1/0431/0820/4708/files/lugogepemunowab.pdf
- https://cdn.shopify.com/s/files/1/0437/4052/8792/files/in_dublin_street.pdf
- https://cdn.shopify.com/s/files/1/0437/5881/3341/files/bulk_up_workout_plan.pdf
- https://cdn.shopify.com/s/files/1/0433/9197/5580/files/ocaml_remove_duplicates_from_list.pdf
- https://cdn.shopify.com/s/files/1/0429/9040/3737/files/79773689688.pdf
- https://cdn.shopify.com/s/files/1/0429/3538/6275/files/99237601915.pdf
- https://cdn.shopify.com/s/files/1/0431/1079/3370/files/xazabolule.pdf
- https://cdn.shopify.com/s/files/1/0427/9032/2342/files/90072290303.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000687f.bin` `d46ce98d4754d8ea768ead16598a6cb6b32985daed45bd0d67b60489bae384b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x687F	5140 bytes
`font_01_sfnt_off000079ee.bin` `3bae1ae69a2fb8916312a875818c17274c9230620dc6e9cf8bc6c71ea03e2d2c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79EE	14732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.