PDF malware analysis — malicious · e7dc0036b00334de

MALICIOUS

PDF

42.7 KB Created: 2020-09-01 06:37:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0734916a6dad5d471612b7d591029fbe SHA-1: 7a72f647b92019048d98c3e8bd3ef19193b85c9f SHA-256: e7dc0036b00334def33c51b7a7bc24a1b6d7359a9f635da858350d0b68a919ca

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic firing for a malicious redirector link, directing users to 'https://ttraff.ru/wix?keyword=bang+bang+movie+songs+free'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links to external PDFs, many hosted on 'static.usrfiles.com'. The document body, though heavily obfuscated, contains references to the same malicious URL and benign-looking PDF filenames, suggesting a lure to disguise the malicious redirect. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=bang+bang+movie+songs+free
- https://static.usrfiles.com/ugd/b8c837_5f19310028e14f2b8cd2f16550b27979.pdf
- https://static.usrfiles.com/ugd/b8c837_54b90e902b8b4aa9ade104185c577f00.pdf
- https://static.usrfiles.com/ugd/b8c837_bf551a7e46aa44c3a958e961fa977820.pdf
- https://static.usrfiles.com/ugd/49be48_535c7825970a48f4832253035e3b286f.pdf
- https://static.usrfiles.com/ugd/98857b_c3643ac998b04a54a3a6d35ffcc85abf.pdf
- https://static.usrfiles.com/ugd/b8c837_02a60b90fdae42d2b0f0ddc9c69aa836.pdf
- https://static.usrfiles.com/ugd/b8c837_34613afffee84039b3d31d112bd4837f.pdf
- https://static.usrfiles.com/ugd/99965f_b380f094cbb84d5db2c2f25e272d723f.pdf
- https://static.usrfiles.com/ugd/451461_3d475cae9f6c4288952f5f4c23fbe19a.pdf
- https://static.usrfiles.com/ugd/9b33c5_e2dbd6f49af54ff7ad6afebc32f9df70.pdf
- https://static.usrfiles.com/ugd/6846fe_ab802d87381f49c6b7956360c92aac5f.pdf
- https://static.usrfiles.com/ugd/e2c6c1_4b72e41644474b829e41594565882a90.pdf
- https://static.usrfiles.com/ugd/cc14e4_44408ea348d64b71859757e3a0d06ba1.pdf
- https://static.usrfiles.com/ugd/739437_31e45a6c5b3d488192bd21dd952dca59.pdf
- https://static.usrfiles.com/ugd/c1de29_d780392a8a374a41afd34749d93bcba1.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004eeb.bin` `88977424ecd8cca49480e08244ce6d42ae289aa9959d69a2bf4f48b767b850fc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4EEB	5012 bytes
`font_01_sfnt_off00005fdc.bin` `43dd73c1b5d67f022ab2e5b16f9804e4d7713d573563e9b48972260ec9024c3c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FDC	15512 bytes
`font_02_sfnt_off00008fd5.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8FD5	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.