PDF malware analysis — malicious · c376a6e1e3785d49

MALICIOUS

PDF

42.3 KB Created: 2020-08-30 19:46:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: caaae1ef6fd0bf32cca8d52e33295887 SHA-1: 72371bab96be38a563683ab3680c292303c2ff89 SHA-256: c376a6e1e3785d49a4f030cf5733a63828fcaabcda53174f5d85ba9d6ae81636

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.ru, which is likely used to distribute malware or conduct phishing. The document body, though heavily obfuscated, contains this URL and appears to be a lure. The presence of numerous links to Shopify domains, some of which are benign, suggests a link farm or SEO poisoning tactic to obscure the malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=cr%25C3%25A8me+de+curling+au+beurre+de+karit%25C3%25A9
- https://cdn.shopify.com/s/files/1/0433/6956/2266/files/myxedema_coma_treatment_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0433/0346/9206/files/fund_fact_sheet_design.pdf
- https://cdn.shopify.com/s/files/1/0431/1796/9570/files/gimajizorewukoludafezi.pdf
- https://cdn.shopify.com/s/files/1/0435/7763/9071/files/guns_n_roses_paradise_city_tab.pdf
- https://cdn.shopify.com/s/files/1/0444/3960/1318/files/93816545242.pdf
- https://cdn.shopify.com/s/files/1/0429/2630/9543/files/bamimokorotoweperid.pdf
- https://cdn.shopify.com/s/files/1/0435/2521/0263/files/ms_excel_2020_tutorial_in_marathi.pdf
- https://cdn.shopify.com/s/files/1/0430/7949/9940/files/diagrama_de_transmisiones_automatica.pdf
- https://cdn.shopify.com/s/files/1/0437/8440/5153/files/rig_veda_samhita_in_sanskrit.pdf
- https://static.usrfiles.com/ugd/b8c837_e74b192ddd1b4f3e8f1d9e7986e3cbf2.pdf
- https://static.usrfiles.com/ugd/bf650e_609aaa07e0c34bed8d66b7654e3f9514.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006143.bin` `988e3b45bf98eda09cc9dd9c37da091b010bfb313a4339d17b30d8c294dc4443`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6143	5476 bytes
`font_01_sfnt_off00007324.bin` `d89515783b850c60f353a591e35ea2a91c8ec216a661b9b6083b7eabcf1c1383`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7324	12500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.