PDF malware analysis — malicious · c97777e259fd6864

MALICIOUS

PDF

44.1 KB Created: 2020-08-30 07:57:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ad92440f07c03bcded1a5456af12239a SHA-1: 05aea9f10dd9e7f2e475243a572c9332ffaca04c SHA-256: c97777e259fd68649acc8146f2ff57753da82210decf5810162be371bc16a8ba

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. This indicates the document is designed to lure users to a malicious site, likely for malware distribution or phishing. The presence of a large number of external PDF links, many hosted on 'static.usrfiles.com', further suggests a link farm or SEO poisoning tactic to increase visibility of the malicious content. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=bootable+windows+xp+sp3+iso
- https://static.usrfiles.com/ugd/f1d680_c01575e7f0da44c7beaa513d0b124c5e.pdf
- https://static.usrfiles.com/ugd/b8c837_22fce6fc27c9450e922b808bbd7a702b.pdf
- https://static.usrfiles.com/ugd/d4a9d6_a1734234f22e4b139599949a60440e5a.pdf
- https://static.usrfiles.com/ugd/b8c837_b5f625c377d245b1b696cb30dbd315c8.pdf
- https://static.usrfiles.com/ugd/b8c837_6a9cd31d2d9843b48d244e41380b1e88.pdf
- https://static.usrfiles.com/ugd/b8c837_854c2fd46a664c888cd916e048a33000.pdf
- https://static.usrfiles.com/ugd/0fdb6d_7c31976e56064b56b9be64276e0ed8b6.pdf
- https://static.usrfiles.com/ugd/3b0c81_4993043c8439467292e3a5356dbb15dc.pdf
- https://static.usrfiles.com/ugd/4e6dd5_d0693a756b3645d98da1cfeef05c6ada.pdf
- https://static.usrfiles.com/ugd/b8c837_a6210fa0add848b795733c8bad17d172.pdf
- https://cdn.shopify.com/s/files/1/0432/6028/0982/files/lowat.pdf
- https://cdn.shopify.com/s/files/1/0436/8619/9461/files/86393029587.pdf
- https://cdn.shopify.com/s/files/1/0433/5563/5880/files/how_to_unfollow_everyone_on_twitter.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/2857609843.pdf
- https://cdn.shopify.com/s/files/1/0431/1593/7948/files/2184942010.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000684b.bin` `4654434cc7a63276b478d3a8a9a901afd21790f77cfb768ab3166a5f62c3d0d5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x684B	5368 bytes
`font_01_sfnt_off00007aaf.bin` `a4e4b4670f6787fd04fbb44ccd7de7f9a7e5497951d2c67d7324795d6eb16de9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AAF	12908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.