PDF malware analysis — malicious · ce101b9937a8fc82

MALICIOUS

PDF

38.4 KB Created: 2020-09-16 02:29:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 113f537048fff1955be2e88a624ef0b2 SHA-1: cf900dda4d5d52a7c2d53cc32ab029806f793187 SHA-256: ce101b9937a8fc820b070b5ce392ffd075cc67bd9cbb6d81cb984c94c9610927

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. The document body, though heavily obfuscated, contains the same URL and text related to a crochet pattern, suggesting a lure. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many pointing to 'static.usrfiles.com'. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=virus+stitch+shawl+crochet+pattern
- https://static.usrfiles.com/ugd/cc15ef_3bec09b2eac74db1bac06d474e4eeb55.pdf
- https://static.usrfiles.com/ugd/cc03df_10518736f4034df59cbd144e623763e2.pdf
- https://static.usrfiles.com/ugd/6a4619_3ae796b4c4304634a1069416c0a09058.pdf
- https://cdn.shopify.com/s/files/1/0433/7103/6835/files/prepa_bac_maths_1ere_s.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/rexalomofovuwazeb.pdf
- https://cdn.shopify.com/s/files/1/0437/2519/3368/files/ignou_b._ed_entrance_2018_answer_key.pdf
- https://static.usrfiles.com/ugd/696117_ac770a3a7d804e858ed6bfb596aad168.pdf
- https://static.usrfiles.com/ugd/144d27_bdb0f329ea7c46a6aa8b159ca8788fce.pdf
- https://static.usrfiles.com/ugd/9117e0_f5d24252260f4badbb862443867d585e.pdf
- https://static.usrfiles.com/ugd/696117_34144849849a47788855f76f2d4521ee.pdf
- https://static.usrfiles.com/ugd/52b593_bce3a74e8d334e898a622d46e22bbd3f.pdf
- https://static.usrfiles.com/ugd/10e3af_31d978eeaeb445cfa90dfa7206df2acd.pdf
- https://static.usrfiles.com/ugd/6a7407_bc7502ebc0e34ee094949b8d00c9a072.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005977.bin` `d85d31198b95d212d3e0c32382406957b362b554d423f273875f33b448a99c62`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5977	5080 bytes
`font_01_sfnt_off00006ad0.bin` `3c38e20af80baa15fa49b07ca6822b606571845ab66cc3a8d2a19e204be2b4ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AD0	9980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.