PDF malware analysis — malicious · d381812e7dd8a096

MALICIOUS

PDF

43.6 KB Created: 2020-09-18 06:45:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a30fd9df73d7490ab7d63639de189c75 SHA-1: 1aa85bb396a07c4ee1058b8852c06ad32994a034 SHA-256: d381812e7dd8a09621f8b2ac144dea0ccfcd5c4bb61c33be78342aef1d046a5e

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'ttraff.club'. The document body, though heavily obfuscated, contains text related to 'all clad slow cooker repair parts' and the URL itself, suggesting a lure. The PDF also contains a link farm heuristic, indicating it's part of a larger SEO-based distribution scheme. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=all+clad+slow+cooker+repair+parts
- https://cdn.shopify.com/s/files/1/0433/3040/4502/files/niduribi.pdf
- https://cdn.shopify.com/s/files/1/0436/4104/5145/files/alessandro_baricco_silk.pdf
- https://cdn.shopify.com/s/files/1/0434/8333/2773/files/nevevoxokonezonezisutub.pdf
- https://1583a2f8-b4e8-47fb-aec5-505007a498fc.filesusr.com/ugd/7baf93_5b4b80a23d624f76af332618f3f5f6e8.pdf?index=true
- https://5c9bb53d-4524-486a-9044-716268a44bd5.filesusr.com/ugd/1cc777_94ec539b77f14e84968dd23312559781.pdf?index=true
- https://bed2a386-21e3-4e6a-af9a-49e1abb55780.filesusr.com/ugd/0ebc1f_7614ef76bfa4495ea717b49050ac3369.pdf?index=true
- https://a01cbf67-3a20-417e-bf69-90ae8e165bb2.filesusr.com/ugd/069df5_9a914448507c4055906b5c9fb0a07ad0.pdf?index=true
- https://682bac5f-e0b6-476c-be5d-488ae1cf3f19.filesusr.com/ugd/97634b_3bbf68c1fc664663af81d3fef2dc7ede.pdf?index=true
- https://40ebde15-eaee-48b7-98ac-a4a10efd0fd1.filesusr.com/ugd/3402b1_746897ebf0d04de1a415747cdd2b9a2b.pdf?index=true
- https://f4cc5341-9236-4a91-a47c-2da4f9e29ee1.filesusr.com/ugd/8da65f_a79a9208b3a742d790e18951da108121.pdf?index=true
- https://cdn.shopify.com/s/files/1/0479/1418/8967/files/habbet_caramel_full_movie.pdf
- https://cdn.shopify.com/s/files/1/0435/4985/1811/files/name_circle_parts_worksheet.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005ec1.bin` `fb498da4855cfe534a0b9cd0d13420811a0b2f2998cbd62826178870eebdedfc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5EC1	4896 bytes
`font_01_sfnt_off00006f87.bin` `a837ecb670f371ad35b9fdeaeb10948a830c023f721509d153adda9809f68813`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F87	10580 bytes
`font_02_sfnt_off000093ab.bin` `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x93AB	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.