PDF malware analysis — malicious · d7b0f59b5208202c

MALICIOUS

PDF

44.2 KB Created: 2020-08-29 20:40:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a9e7f2efebe3227df10d8eb043e24677 SHA-1: 906956d066782e0aa5ef580dbb3d5838c1673f10 SHA-256: d7b0f59b5208202c8a494857b7608a7173cd22dbf80fb1c0f0b94a5b1644dc33

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.me, which is designed to lead users to malicious content. The document body, though partially corrupted, contains the same lure text as the redirector URL, suggesting a coordinated phishing attempt. The presence of numerous other PDF links, many pointing to static.usrfiles.com, indicates a link farm strategy to improve search engine visibility for the malicious lure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=how+to+defeat+ancano+in+skyrim
- https://static.usrfiles.com/ugd/b8c837_c16040f2b1494269afa06d1499528da4.pdf
- https://static.usrfiles.com/ugd/b8c837_c4ad0c5470d84547a3b459b64627caf4.pdf
- https://static.usrfiles.com/ugd/374ce0_4daa05ee7ef1446a940f54c516d875e7.pdf
- https://static.usrfiles.com/ugd/b8c837_2658332a4a594287b0714e00d0268fc4.pdf
- https://static.usrfiles.com/ugd/b8c837_c808b6b09c1e45648afa93b61cb4a8ea.pdf
- https://static.usrfiles.com/ugd/b8c837_425172f5ef1142d281c972b79a3e1579.pdf
- https://static.usrfiles.com/ugd/b8c837_ba607913a8904a358d37d38dc01a3227.pdf
- https://static.usrfiles.com/ugd/b8c837_496c8eb36ba64e1a8770a0d32e39d74c.pdf
- https://static.usrfiles.com/ugd/b91566_a66838f0013b415e83c4f164ba9bd329.pdf
- https://static.usrfiles.com/ugd/0d9a50_5a2c9af15ade4d0b8ed88d5872d00a93.pdf
- https://static.usrfiles.com/ugd/b8c837_9f0d3d6ca38d4041bed68ad744c9a8c9.pdf
- https://static.usrfiles.com/ugd/097bd5_6f46d25dbbbf489fb596d82bdde9483b.pdf
- https://static.usrfiles.com/ugd/b8c837_61e9ac62fda44b49bbb4f0c32d5f05b1.pdf
- https://static.usrfiles.com/ugd/b8c837_b3b49f95a5c642d592cd8b27a3dfc7db.pdf
- https://static.usrfiles.com/ugd/b8c837_6bb7376ddafa4b858ccae59bcf8f2591.pdf
- https://static.usrfiles.com/ugd/9cfd0a_fd6621baafda4d4ea57c321103e2cf81.pdf
- https://static.usrfiles.com/ugd/696b8a_1bacb7b7034243038517adfe9aa4cbe0.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000703d.bin` `fcb82bac99b708935e9b587e548b596ca896b54357ebf18ed6e92188a4d3eb81`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x703D	5356 bytes
`font_01_sfnt_off00008270.bin` `d974a1a957e2aa1047a46e9fea2ea455aabaf19f169304a34d4f4e88895b4f7b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8270	9896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.