PDF malware analysis — malicious · ccb52d4fc91e3784

MALICIOUS

PDF

70.2 KB Created: 2020-08-30 23:26:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a15f5a4b99ed5a9c830b9aeaa89578ad SHA-1: 33698cfeb59dc0d46b504130d731009c527fa465 SHA-256: ccb52d4fc91e3784500c97de2fd80cfb5d4d161b7b5a98c3e41a1323ad79f823

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the same URL, suggesting it is the primary lure. The PDF_SEO_LINK_FARM heuristic indicates the PDF is part of a larger link farm designed to manipulate search engine results, further supporting the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=cadena+de+favores+pelicula+completa
- https://static.usrfiles.com/ugd/b8c837_806b2b18fa214e2bacc28d818837308f.pdf
- https://static.usrfiles.com/ugd/b8c837_5d6deec0ed734868ab6adadb3c7a2167.pdf
- https://static.usrfiles.com/ugd/b8c837_c1206fbd2697436f99aac9899033b8ba.pdf
- https://static.usrfiles.com/ugd/5fd5c1_00d905c9804d480bad7973c86dc4f3c9.pdf
- https://static.usrfiles.com/ugd/b8c837_eca20d8d80864686b7b0ff98c33d8a2f.pdf
- https://static.usrfiles.com/ugd/b8c837_8b93aab9b6534946a35ba9b8ba8cb8e9.pdf
- https://static.usrfiles.com/ugd/b8c837_259b529153ee4d06878348b75a9551b3.pdf
- https://static.usrfiles.com/ugd/a2e20a_3e96824b85b04b0781d3c09338492add.pdf
- https://static.usrfiles.com/ugd/b8c837_de221f358af14cefb7bdd19a92485e94.pdf
- https://cdn.shopify.com/s/files/1/0440/1076/6486/files/rexolezi.pdf
- https://cdn.shopify.com/s/files/1/0431/3546/7669/files/45953281580.pdf
- https://cdn.shopify.com/s/files/1/0428/5281/0911/files/study_spanish_comparisons_of_equality_answers.pdf
- https://static.usrfiles.com/ugd/b8c837_13949a42db8247f8b44fcf2be7f40b70.pdf
- https://static.usrfiles.com/ugd/455f95_3e5bc0781b074f9383f883c5f8fa9ed4.pdf
- https://static.usrfiles.com/ugd/b8c837_64f0dd99f05a4b548b776fd9b4b409ed.pdf
- https://static.usrfiles.com/ugd/b8c837_5915ebbfb8bb455f8e6a356e97e78d53.pdf
- https://static.usrfiles.com/ugd/b8c837_39521c72e508469eb1881f03761e2d75.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d367.bin` `a3ace210d33c3bcf80fc9ad0e614f0eee123e87b559a8fd9fc7de15c03f02b47`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD367	5264 bytes
`font_01_sfnt_off0000e53f.bin` `ca95d195d79a64c3f5060259b9ffd7bd3ae9044027c57c7ee43007539a4212ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE53F	11256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.