PDF malware analysis — malicious · c69b6777e07289b2

MALICIOUS

PDF

42.0 KB Created: 2020-08-29 17:25:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 069f6996669c579c7e8d9cdf98354c63 SHA-1: 7838e75d0361423ef6d187e7ea922379acb4e2df SHA-256: c69b6777e07289b2e05e2c4d829d5d94247b7f8f4f84e2e95b0470fa718523f8

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link disguised as an educational worksheet, which redirects to the malicious URL https://ttraff.com/wix?keyword=all+about+me+worksheet+for+grade+1. This URL is flagged as a malicious redirector. The PDF also contains a large number of links to external PDFs, suggesting a link farm or SEO poisoning attempt. No scripts were extracted, but the overall structure and the malicious redirector strongly indicate a phishing or redirection attack.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=all+about+me+worksheet+for+grade+1
- https://static.usrfiles.com/ugd/b8c837_7164653375814b81ac3ed7067aff12c3.pdf
- https://static.usrfiles.com/ugd/b8c837_bd4acb38045a4046a16ca65672c60129.pdf
- https://static.usrfiles.com/ugd/d55797_f821360fd81d47158b35dd7e47fb4bec.pdf
- https://static.usrfiles.com/ugd/b8c837_c67ac548abd5477f94ec77f1fc2067fa.pdf
- https://static.usrfiles.com/ugd/b8c837_8810646556304b8db3d75e64039a340e.pdf
- https://static.usrfiles.com/ugd/5b9a87_77930fc83f174c61bd9be18d43f0c00d.pdf
- https://static.usrfiles.com/ugd/b8c837_d60ebab9554d4247b20a0034793baf23.pdf
- https://static.usrfiles.com/ugd/05900a_af11713a93ec4d7a9880715ed1bbb1b8.pdf
- https://static.usrfiles.com/ugd/b8c837_9e1c665a6c0f4ef59084568526fe18b9.pdf
- https://static.usrfiles.com/ugd/b8c837_3297023679d549498317115d8b4c9a26.pdf
- https://static.usrfiles.com/ugd/b8c837_ba81411a5788433eb5a317c500da141c.pdf
- https://static.usrfiles.com/ugd/3b0c81_c098c79962b8450aaa8cebdbae3db7c6.pdf
- https://static.usrfiles.com/ugd/b8c837_7bc2e472518c4cb5971b155f53cfe5c8.pdf
- https://static.usrfiles.com/ugd/b8c837_976822f605494c2280f25cbafcfbd61d.pdf
- https://static.usrfiles.com/ugd/b8c837_f1688ae0d4854c749b564f0fb6d15fe0.pdf
- https://static.usrfiles.com/ugd/b8c837_549668fe74c84a5fa69fdb3cada5376a.pdf
- https://static.usrfiles.com/ugd/b8c837_1e801cfe74ae4804bee56ed40a5a27b0.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000063e7.bin` `018f53ac6e6ef409e23ee1612e0299095e2d6faaf35d75553fef69878fd63118`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x63E7	5656 bytes
`font_01_sfnt_off0000771b.bin` `1688ee19ffb2a671e7dad689fb17a178eb03cdab5fe5ed03ec5e5bb58e5c76aa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x771B	10628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.