PDF malware analysis — malicious · c2f74729fb47fc47

MALICIOUS

PDF

42.1 KB Created: 2020-09-03 11:58:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2775e404caaf5612ff07fa4514efb12e SHA-1: d16aba0dd8d364b1ed61623c3dd5a5a028ea0ba2 SHA-256: c2f74729fb47fc47a1cbe270da6fb502b0b5877d01c31cbd413b5fa043c1f18c

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. The document body, though heavily obfuscated, contains the same URL, suggesting a lure to a malicious site. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=worry+free+money+shannon+lee+simmons+pdf
- https://static.usrfiles.com/ugd/8b2c09_299f0e05064b4fa88dae4e67a3c1180d.pdf
- https://static.usrfiles.com/ugd/585b1d_a7debfa2e56142ccbb326bd1413fea97.pdf
- https://static.usrfiles.com/ugd/2ca09c_91bba5f8167a4d00937d4a571e4f87de.pdf
- https://static.usrfiles.com/ugd/b8c837_11aa4c9333a142c0af0c7741f0e27970.pdf
- https://static.usrfiles.com/ugd/b8c837_39c939d003e74f1b8d0ab7e03bb1a966.pdf
- https://static.usrfiles.com/ugd/01bc73_79eaaf722f894fa58381a4f0bfa72251.pdf
- https://static.usrfiles.com/ugd/49be48_1223b6ae216a4a0a83ea63b81d63db53.pdf
- https://cdn.shopify.com/s/files/1/0437/0045/3541/files/93006049853.pdf
- https://cdn.shopify.com/s/files/1/0439/4424/7451/files/organelles_function.pdf
- https://cdn.shopify.com/s/files/1/0431/6630/2357/files/fupakeputufu.pdf
- https://static.usrfiles.com/ugd/b8c837_da30d6ebb71e486ba35eac40279845ff.pdf
- https://static.usrfiles.com/ugd/5b9a87_cec40c76ca634c309bd01f91cd73c40c.pdf
- https://static.usrfiles.com/ugd/99afdc_a4effa0725d24a709cd25fc572c0344c.pdf
- https://static.usrfiles.com/ugd/5d2cf3_529d50e6c221446683696d569f8c1b2b.pdf
- https://static.usrfiles.com/ugd/429b25_5ee164b68ed848a3a639825812676c96.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000064a7.bin` `9749f05365128a38d39e270a2bab86c10f48f85f32c1ae5bd550ef761b6af898`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64A7	5396 bytes
`font_01_sfnt_off000076eb.bin` `9215aaefea2ded82b682fb7265235cb1787e638d6843f274ffb79df4dc96711b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x76EB	11040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.