PDF malware analysis — malicious · dfc7416e4287a053

MALICIOUS

PDF

43.1 KB Created: 2020-08-30 01:05:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b2376f493237fd8b749e3b5a0e73d653 SHA-1: a8de335e204892af15de48b6d37defc7a69a17a3 SHA-256: dfc7416e4287a0531d412358882f80c53fef6d61f13f758e9ea6d74a6094ea38

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a deceptive title related to PowerPoint tools, likely to entice users to click on embedded links. The primary link, 'https://ttraff.com/wix?keyword=herramientas+de+power+point+2016+y+sus+funciones', is flagged as a malicious redirector. The document also functions as a link farm, containing numerous external links, many of which point to 'static.usrfiles.com'. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=herramientas+de+power+point+2016+y+sus+funciones
- https://static.usrfiles.com/ugd/b8c837_ab2b05f74c414cb7b4fb22603b6603d8.pdf
- https://static.usrfiles.com/ugd/ade4e6_25c1343f6f1840e6b2be54717f44d507.pdf
- https://static.usrfiles.com/ugd/d1d005_b3100cc8ba7144da9be9c8c154f274a6.pdf
- https://static.usrfiles.com/ugd/b8c837_7defd885b47d499c902e3ab214b45bd3.pdf
- https://static.usrfiles.com/ugd/b8c837_95e5cb01b1154f729be73f86dfc0e7f6.pdf
- https://static.usrfiles.com/ugd/b8c837_caaba8d62c9f49278d45ca32e7757fe3.pdf
- https://static.usrfiles.com/ugd/b7ed05_ceebc63c88444a1a8414485dce58f1f4.pdf
- https://static.usrfiles.com/ugd/5899d5_d49e0f14bf324b51873991306be6fb40.pdf
- https://static.usrfiles.com/ugd/0dd040_3bec742f1f584b61b35bfea9ca0fedcf.pdf
- https://static.usrfiles.com/ugd/3b0c81_2addc9bc52eb4179a7f7a93233e95874.pdf
- https://static.usrfiles.com/ugd/9ff9b8_0f653474342d461680fe833165c86d92.pdf
- https://static.usrfiles.com/ugd/7baf93_cd1d7cc6f53c44cea6978da2351f77e8.pdf
- https://static.usrfiles.com/ugd/b8c837_c3a0684e3e0f4a4e8832b2a17d4eba19.pdf
- https://cdn.shopify.com/s/files/1/0434/4777/9478/files/zeguxanizeludamoxu.pdf
- https://cdn.shopify.com/s/files/1/0429/4855/9004/files/55464246700.pdf
- https://cdn.shopify.com/s/files/1/0438/3178/7670/files/latter_and_former_word.pdf
- https://cdn.shopify.com/s/files/1/0433/4957/3784/files/18779620505.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/3b0c81_2addc9bc52eb4179a7

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006637.bin` `6882b3d9234abae8878e8bab942ceddef6b05fbf0aacbb7193a9d0a0a7a5c51f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6637	5904 bytes
`font_01_sfnt_off00007a4f.bin` `2df772f3b19a2e92dc58b5c49c2992f4486028f55395c7d53f4036efc937da7b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A4F	10672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.