PDF malware analysis — malicious · e36145aa8d7016f0

MALICIOUS

PDF

39.3 KB Created: 2020-08-30 04:09:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 340a7794b4425ae01f0f32e777389829 SHA-1: 48cb36dc7970ea05c929a613e6906b63c180ef62 SHA-256: e36145aa8d7016f0b93787a54750d3c09f5beaed6cb3012664c1b1cfb58009f1

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, contains references to 'Google hangout apk' and the malicious URL, suggesting a lure. The presence of numerous external PDF links, many hosted on 'static.usrfiles.com', indicates a link farm strategy, likely to obscure the ultimate destination or to improve search engine ranking for malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=google+hangout+apk
- https://static.usrfiles.com/ugd/b8c837_3daa7cc62bae48708f7609399e071a1b.pdf
- https://static.usrfiles.com/ugd/0c41e7_c2c54f190182435abda221853784c2ed.pdf
- https://static.usrfiles.com/ugd/b8c837_c4dda66298124c45b7c90b0a0761bc49.pdf
- https://static.usrfiles.com/ugd/576447_87acf43aa30b4c0688c33d26ebab8075.pdf
- https://static.usrfiles.com/ugd/b8c837_e9e377371a5b4457b6a196d957fd3a1a.pdf
- https://static.usrfiles.com/ugd/b8c837_fde0e5f9ecf94f0f8fa19f126ef7d74a.pdf
- https://static.usrfiles.com/ugd/b8c837_d498658909be4c4493315e4232fe3544.pdf
- https://static.usrfiles.com/ugd/b8c837_5d3eaac2a38240d69a3c4cc886b3f5d3.pdf
- https://static.usrfiles.com/ugd/9f6a24_c38c42877a1048c9851bc78525b8e299.pdf
- https://cdn.shopify.com/s/files/1/0436/6116/4697/files/49032557237.pdf
- https://cdn.shopify.com/s/files/1/0429/1995/2550/files/arizona_state_university_map.pdf
- https://cdn.shopify.com/s/files/1/0433/3630/2750/files/polking_differential_equations.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d73.bin` `bdee236093c1b4b5b6c286abc0999d6234db8bef9aecef14fc1eac00b8596257`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D73	4904 bytes
`font_01_sfnt_off00006e27.bin` `e65da3cd6e650a8b056b6e0286bfa4d6224b81ed9444f8820da2b4f0f2eda558`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6E27	10356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.