PDF malware analysis — malicious · c08849ea8c3f0377

MALICIOUS

PDF

41.8 KB Created: 2020-09-07 00:02:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 015a4c3469b3894d495ae4e6a8f4d519 SHA-1: 3f28ac4fb7e31d1eaad63df38bb705647fd5ef16 SHA-256: c08849ea8c3f0377824e761a07e2c9f50c23e56452790e23911735adcdcb9e52

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm with 16 external links, including a redirector to a URL associated with malicious activity. The primary malicious URL identified is https://ttraff.link/wix?keyword=turn+on+dark+mode+facebook+android. The document body is heavily obfuscated but contains references to the redirector URL and other benign-looking PDF files hosted on static.usrfiles.com, suggesting a lure to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=turn+on+dark+mode+facebook+android
- https://static.usrfiles.com/ugd/dd4472_02d568e478344f9a935ae4b219874b14.pdf
- https://static.usrfiles.com/ugd/f84671_2ca387ebbea940ee9bbfcaf74712198e.pdf
- https://static.usrfiles.com/ugd/fb41f9_f36366a0034c46da985723fa7ab551f6.pdf
- https://static.usrfiles.com/ugd/b88e3d_1ccbcad38e17497dac5dfb74ebae3482.pdf
- https://static.usrfiles.com/ugd/299074_0fc4dff6c6e048a5aba58541097f5dca.pdf
- https://static.usrfiles.com/ugd/165585_693ee86c93074ad892a3748006e86b47.pdf
- https://static.usrfiles.com/ugd/abd6ea_6a921cb214de47928078ba98754b3e4b.pdf
- https://static.usrfiles.com/ugd/3c8574_b8543a6bf9fe4bdea1d7c253224f3f2a.pdf
- https://static.usrfiles.com/ugd/205ae4_1b932f061b0745ce8030b36a5a9ca21e.pdf
- https://static.usrfiles.com/ugd/a421e3_4e938679965d4851bba2b118c1313e6a.pdf
- https://static.usrfiles.com/ugd/eddc50_4f1c81ec22c2457387108210cab149a2.pdf
- https://static.usrfiles.com/ugd/bf07b1_20ae7afd8b774606a604f198eecc0461.pdf
- https://static.usrfiles.com/ugd/fb5067_dd330d7598df4f27897c30f6245fbbd5.pdf
- https://static.usrfiles.com/ugd/b8c837_574b4fec45da492e8caa4cedde46f2f9.pdf
- https://static.usrfiles.com/ugd/ad2ade_2fbfddfaa6564d0a8ebc5fd74e2ef59f.pdf
- https://static.usrfiles.com/ugd/2f3ac6_dc53c84e012e4e0f9614d5cfff25e691.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000652b.bin` `9b774a15ab274bbd4712d01e3d4db3695320397b65249209a1aeefe90207035c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x652B	5112 bytes
`font_01_sfnt_off00007683.bin` `194f13fbe7995a237c731ced92923644d8f39849ba171d6ab972517d8e535a26`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7683	10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.