PDF malware analysis — malicious · d534e95dabaefbf1

MALICIOUS

PDF

42.6 KB Created: 2020-09-01 11:10:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9dca75279d93b38a3725535fea8ee56a SHA-1: 02dfb61e48150f510d97f35831c4c1a7061d8233 SHA-256: d534e95dabaefbf170a1b1063d081f0abf7ef77e6669c0f2715b589a84d94566

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified as a PDF link farm. One of these links, 'https://ttraff.cc/wix?keyword=manuel+antonio+atv+guided+tour', points to a known malicious redirector. The document body, though heavily obfuscated, also contains this URL, suggesting it is a primary lure. The presence of numerous links to static.usrfiles.com, while flagged as benign, contributes to the overall link farm characteristic.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=manuel+antonio+atv+guided+tour
- https://static.usrfiles.com/ugd/f515ca_7f98735ad952481e803706dd0f77ab79.pdf
- https://static.usrfiles.com/ugd/0a0016_cfa07d00cb824fea9bcc6724b9035e48.pdf
- https://static.usrfiles.com/ugd/b8c837_e424923aca544ce1ab1e1149db64f814.pdf
- https://static.usrfiles.com/ugd/1c90dc_a65898808b9d478ab1ea4aa8a86ce55e.pdf
- https://static.usrfiles.com/ugd/96bf9d_f827501225c047f3bb0652f8b46f3a83.pdf
- https://static.usrfiles.com/ugd/963627_69305d4338ea489ca3cc5d06214e8387.pdf
- https://static.usrfiles.com/ugd/ecec20_81622dc3db494368aacf636804ae1e81.pdf
- https://static.usrfiles.com/ugd/83d902_b55f6de6771849dfb6f6cb435234a38b.pdf
- https://static.usrfiles.com/ugd/6908d7_ad7971d8d76747a386378e98d6adaff1.pdf
- https://static.usrfiles.com/ugd/9c0842_d622972eddcc495a8f6e3bf76b91c4e2.pdf
- https://static.usrfiles.com/ugd/b3bc21_7ee02b919b9944cd8753f4e0d5bbac37.pdf
- https://static.usrfiles.com/ugd/b8c837_2b1b63a1a5464ea5ad75349c5086a720.pdf
- https://static.usrfiles.com/ugd/544c7e_2f2d8f03f6c2446fa128dde8a850132d.pdf
- https://static.usrfiles.com/ugd/de3d83_da20adcf70224bdfa134239afd6767d5.pdf
- https://static.usrfiles.com/ugd/b8c837_8df74262b403471d8adc9018a728f5bf.pdf
- https://static.usrfiles.com/ugd/b8c837_3f5bd3672fd04c2cb623c5c4069d3481.pdf
- https://static.usrfiles.com/ugd/5a1791_0c4894ae95d64bb48acd2e1d6ed8959e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000688a.bin` `83783a8fc632895ba73fe513ec583ce6e0825b21d10b1c2381847c6237e441c5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x688A	4880 bytes
`font_01_sfnt_off00007944.bin` `909e339e45ab63153727e3e1240ec6e04e4269d3df087a72ebeb7cb5cb4fc0ea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7944	10644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.