PDF malware analysis — malicious · bf217297fcb81a5f

MALICIOUS

PDF

40.4 KB Created: 2020-09-06 01:38:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a2e653e07a0cc68626b54ef8997d5ae0 SHA-1: 3c44c28a4ce407fff5ba0eddb5f20d5ea6ea2cb0 SHA-256: bf217297fcb81a5fae37ac9e64c15508ad5355dfe94f38a69423ead8e7753d7d

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a manual for a Baofeng portable radio. The link leads to `https://ttraff.link/wix?keyword=baofeng+portable+two-+way+radio+manual`, which is flagged as malicious. The document also contains a large number of embedded links, many pointing to `static.usrfiles.com`, which is identified as a link farm. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=baofeng+portable+two-+way+radio+manual
- https://static.usrfiles.com/ugd/6a44d8_bee378d808224c339b66d5d62f22ddd2.pdf
- https://static.usrfiles.com/ugd/cd79e3_d57219b8b5574dc08187636676771ee4.pdf
- https://static.usrfiles.com/ugd/2ca22b_4542faf52e024af89f117b108c97ad88.pdf
- https://static.usrfiles.com/ugd/51c472_ded1092ef98f49bc8c977f9711e9d92f.pdf
- https://static.usrfiles.com/ugd/b8c837_c83f09f74119469e8cda89061375930c.pdf
- https://static.usrfiles.com/ugd/362633_b670ae43c1b643fa9d1dd087bc9edf93.pdf
- https://static.usrfiles.com/ugd/111c46_07fd1b564c59440092b3f7cc0050c2e0.pdf
- https://static.usrfiles.com/ugd/b8c837_c1b09fe3458b4864bedc3aacab44d508.pdf
- https://static.usrfiles.com/ugd/3d0627_df8c00d408fd4f8981ad6413abf9ef50.pdf
- https://static.usrfiles.com/ugd/d94ae5_cfefb5da74f14909ac5e06c362773b76.pdf
- https://static.usrfiles.com/ugd/6c032c_f00276c4702145ab95034f44eaf3b943.pdf
- https://static.usrfiles.com/ugd/cfa91a_396e933dab294c1b8c372d7e6f88fc63.pdf
- https://static.usrfiles.com/ugd/b8c837_617fdbd2671548e68497e571a57e0c68.pdf
- https://static.usrfiles.com/ugd/5ed537_5a2bcf93f0bd4fcbbfeda7d28fc73650.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000051d4.bin` `bc3ab2bdb30a09a6c5a1a004dd4cf3c977df51c8493a3bc049c24cefc5ce80da`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51D4	5480 bytes
`font_01_sfnt_off00006479.bin` `907e3c7abcb5a52fe63b5123a09bea194136bd8317effaa00899dac984ec5797`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6479	9944 bytes
`font_02_sfnt_off0000867e.bin` `4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x867E	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.