PDF malware analysis — malicious · cd2e08f58aac1111

MALICIOUS

PDF

40.0 KB Created: 2020-08-30 23:03:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0b72c3417d56091bd0b7191f6dab3627 SHA-1: dbc3188871a7eca012e28bde952a0c06304c8e93 SHA-256: cd2e08f58aac1111e266dc4bf3230285d4415fec7a9438ce44a517f5f4c91fe3

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a high number of embedded links, many pointing to static.usrfiles.com, but one critical link directs to ttraff.com, identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'business budget template ppt' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=business+budget+template+ppt
- https://static.usrfiles.com/ugd/b8c837_47e4f217def14a49a6bad2a3b6129161.pdf
- https://static.usrfiles.com/ugd/9cc572_cc42df6b35a645549b0fd222409921cb.pdf
- https://static.usrfiles.com/ugd/a298ce_dec47d683af146899898d8b75e56e6cc.pdf
- https://cdn.shopify.com/s/files/1/0438/4250/2818/files/celtx_script_for_mac_free.pdf
- https://cdn.shopify.com/s/files/1/0434/0154/3830/files/define_triple_bottom_line.pdf
- https://static.usrfiles.com/ugd/b8c837_7c5a5f1c004b43e59988ca5e22f8c7ce.pdf
- https://static.usrfiles.com/ugd/3bcfef_9b7998daa9ab4c46a6d5247fed820c09.pdf
- https://static.usrfiles.com/ugd/b8c837_d960f1f71f894325888f121507b199c6.pdf
- https://static.usrfiles.com/ugd/32777b_2d13ce0ea4e14dc7ae9b4dff65c8566a.pdf
- https://static.usrfiles.com/ugd/b8c837_b2310afeaac745869d814c728603b873.pdf
- https://static.usrfiles.com/ugd/b8c837_4ffec7ef8bf841e1aef717cf53b69edb.pdf
- https://static.usrfiles.com/ugd/b8c837_0f6ca73f67e24d3f811886b111bc1d4b.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005c99.bin` `4a01caefca03347270c2e641fb91ab4b9e970d5a6ed37d86baca85099612c3d8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C99	5372 bytes
`font_01_sfnt_off00006eba.bin` `75da9f644b7034f397a6d74bc10464a565e5bb511acfd13f011f8f2f0790cde9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6EBA	10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.