PDF malware analysis — malicious · db9d743bb9690dc6

MALICIOUS

PDF

38.1 KB Created: 2020-09-01 04:54:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 01968f4f5549df236603a3e919c7880e SHA-1: 8ef032286a4e27f8388c72cfafd065d51b3041c9 SHA-256: db9d743bb9690dc634abb447e58f3e7f4fb79f20a4d9be4723f4cefdc40715c9

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged as malicious by multiple heuristics, including a critical finding for a link to known malicious redirector infrastructure. The document body contains a large number of embedded URLs, forming a link farm. The primary malicious URL identified is https://ttraff.cc/wix?keyword=jaya+kishori+bhajan+video+hd+free, which likely serves as a lure or initial stage for further malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=jaya+kishori+bhajan+video+hd+free
- https://static.usrfiles.com/ugd/70c1f8_e835971b4d244105b47ee417396ff552.pdf
- https://static.usrfiles.com/ugd/b8c837_e5cb08bb1ce948bca0a88109ccda71a8.pdf
- https://static.usrfiles.com/ugd/e2b09b_7d60a5ab81bc4d358402cdac130d925c.pdf
- https://static.usrfiles.com/ugd/1b8612_c85ac1c25442417fbd9fb9ac8c995a35.pdf
- https://static.usrfiles.com/ugd/0dcf4b_76f68d4323314434bd15854d68055023.pdf
- https://static.usrfiles.com/ugd/bb13a2_0e3dd70777474d519b506af81565b5f7.pdf
- https://static.usrfiles.com/ugd/c1615c_a205b4c97e0a491080b40ceb7c2e0e15.pdf
- https://static.usrfiles.com/ugd/2e79a6_fb5ef61c73da45f4a334e7782d6b7c1b.pdf
- https://cdn.shopify.com/s/files/1/0440/5103/8358/files/63516013780.pdf
- https://cdn.shopify.com/s/files/1/0433/1569/1675/files/50138382101.pdf
- https://cdn.shopify.com/s/files/1/0461/1997/7124/files/alchemy_guide_archeage.pdf
- https://cdn.shopify.com/s/files/1/0427/7813/2636/files/persuasive_writing_organizer.pdf
- https://cdn.shopify.com/s/files/1/0429/2821/0073/files/62181198040.pdf
- https://cdn.shopify.com/s/files/1/0431/7547/7407/files/aviagen_turkey_breeder_management_guide.pdf
- https://cdn.shopify.com/s/files/1/0434/6452/3926/files/jekirebulabujuwasuv.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004a79.bin` `02cc754974a8675cc4e55c8fb8086f7abfae2198785b7425095b8ba0a61b12c6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4A79	5104 bytes
`font_01_sfnt_off00005bd1.bin` `db7825c93d012e05ac21ffff8212a462f554447c5a672b946a2c94be89a1d59b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5BD1	9852 bytes
`font_02_sfnt_off00007daf.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7DAF	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.