PDF malware analysis — malicious · da972b6bc3b075f9

MALICIOUS

PDF

43.2 KB Created: 2020-08-29 22:06:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c9aaf08e1b41745cfe432b460b1020ec SHA-1: 43c1911f59f1174ea8d673c9b925023317280a43 SHA-256: da972b6bc3b075f9a95912f9d7771359a26672608f752b5a3cb355f92bd2f0b0

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link disguised as a book purchase. The document body and embedded links suggest a lure to a malicious site. The ML classifier strongly indicated maliciousness. The primary malicious IOC is the ttraff.com redirector URL.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=rus%25C3%25A7a+kitap+sat%25C4%25B1n+al
- https://cdn.shopify.com/s/files/1/0434/1504/4254/files/c_template_class_enum.pdf
- https://cdn.shopify.com/s/files/1/0430/8982/1847/files/23608889724.pdf
- https://cdn.shopify.com/s/files/1/0462/5943/7717/files/sifojurenimobageponuk.pdf
- https://cdn.shopify.com/s/files/1/0429/9728/5027/files/andhra_jyothi_epaper_guntur_district_edition.pdf
- https://cdn.shopify.com/s/files/1/0450/0806/0574/files/sample_letter_of_acceptance_of_appointment.pdf
- https://cdn.shopify.com/s/files/1/0431/5706/1781/files/3721987512.pdf
- https://static.usrfiles.com/ugd/b8c837_b832b9a38e744de4ad2ae6d6bb618ed0.pdf
- https://static.usrfiles.com/ugd/b8c837_874d9c6da6c144c6b21e727e9e793d03.pdf
- https://static.usrfiles.com/ugd/b8c837_8d82f48c52684b2cb2f4299c37467ed4.pdf
- https://static.usrfiles.com/ugd/5b604d_8bc675e72165416a9767cb967ef268b8.pdf
- https://static.usrfiles.com/ugd/3aca14_46cb34fc84774e3c9ef0d6d2daabb9e4.pdf
- https://static.usrfiles.com/ugd/b8c837_0202632f4e124db693db91f62f856c52.pdf
- https://static.usrfiles.com/ugd/b8c837_f6f01d067cf54a63b6bc79927bb47493.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f83.bin` `6d5606680870a45ccdb7e04699339f63b37d5df5cb7b2814c443b9ac26f84ef1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F83	5000 bytes
`font_01_sfnt_off000070a0.bin` `ad2ecbf65fd165143ac6a78439975799cc59c96c56195f0292f83e29b54ca722`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x70A0	15524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.