PDF malware analysis — malicious · d6c573fe4191b9ee

MALICIOUS

PDF

48.0 KB Created: 2020-09-22 19:12:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 028567f0d6d7fa08e27a8bd41ca33277 SHA-1: c450a600e4c582e7e801d961acb210bf0418b666 SHA-256: d6c573fe4191b9eec852c02a53a2f28e8fdcb459b26584e44b6024bb8434b69d

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains numerous embedded links, with critical heuristics identifying it as a malicious redirector and a link farm. The primary URL, https://ttraff.com/wix?keyword=principio+de+pascal+fisica, is flagged as a malicious redirector. The document body appears to be obfuscated or corrupted, but the presence of multiple external PDF links suggests a coordinated effort to distribute malicious content or conduct phishing attacks. The ML classifier strongly supports the malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=principio+de+pascal+fisica
- http://bubix.taiwancarparts.com/uploads/1/3/2/8/132815828/vukajibes.pdf
- http://boroxafub.larkhallbowlingclub.com/uploads/1/3/1/1/131164557/nipupegel_sukivebuj_pilitu_sotuwotit.pdf
- http://tejoti.kingdomofbenin.com/uploads/1/3/0/8/130814328/f9d1fd.pdf
- https://cdn.shopify.com/s/files/1/0484/4355/6008/files/minecraft_skins_template_girl.pdf
- https://cdn.shopify.com/s/files/1/0429/6884/2393/files/18885202707.pdf
- https://cdn.shopify.com/s/files/1/0437/3420/4567/files/aristteles_filosofia.pdf
- https://282e13fc-a330-4b3e-9d03-0e02cbcf5615.filesusr.com/ugd/4d548e_5a1ee432c4b34b188a3b58abc6f0fd36.pdf?index=true
- https://f55acf91-8b5c-4e68-a2e4-e03be563b868.filesusr.com/ugd/8f6098_91f92c9be4804fdca6bf86410ae47078.pdf?index=true
- https://15af3b7d-70d8-4a76-8ddf-af9a3d352f97.filesusr.com/ugd/2dbf5a_a82645e972684b0bb6cb1cc9080e58b8.pdf?index=true
- https://12a184ed-d068-45c1-9df7-9f4824c5f589.filesusr.com/ugd/9f2514_6dc6b09797904c59aab5f52b5ec0af84.pdf?index=true
- https://c637cc29-4f0f-4132-8f4e-10045f32e6a0.filesusr.com/ugd/8a9bcc_5a8a965dfb5946b4964c05281a0ef84d.pdf?index=true
- https://438facff-37a1-4b8a-a5f9-c046e993a6f6.filesusr.com/ugd/77941b_df09ea2891e84e31812a36cae70cd831.pdf?index=true
- https://66f558be-277d-4979-aca6-787e8991fb3c.filesusr.com/ugd/b6bf5b_1a4b33ae462349b4ba243a45448467bd.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000728b.bin` `5aac25d53dfdb3fefa8b22292059aba9c5d2d803d576d319ee0d08292227dad3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x728B	5152 bytes
`font_01_sfnt_off0000841d.bin` `c3150d70744b4a8766bb6b09e900b057aa6115c4d54e271ff9af379517807f4a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x841D	14724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.