PDF malware analysis — malicious · e8c48016d37f82b6

MALICIOUS

PDF

41.9 KB Created: 2020-09-04 17:57:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0309812f3436fbcadeb6267264d45473 SHA-1: 7db1962baf2865a347ce6a28a7265f8334480218 SHA-256: e8c48016d37f82b656c5fd58eb975548d411debef0a359306addc25bc13051ba

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a deceptive document body and a critical heuristic firing for a malicious redirector link. The link, 'https://ttraff.me/wix?keyword=jk+copier+paper+a4+500+sheets', is presented in a way that suggests a product listing, likely to trick the user into clicking it. The link redirects to known malicious infrastructure, indicating a phishing or malware distribution attempt. The presence of numerous other PDF links, many pointing to the same domain, suggests a link farm used for SEO poisoning or to obscure the final malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=jk+copier+paper+a4+500+sheets
- https://static.usrfiles.com/ugd/f65518_1a4c8644b8044beab4d350e793262b02.pdf
- https://static.usrfiles.com/ugd/0af078_b9f2bb9b34844261922a338de0b38aa7.pdf
- https://static.usrfiles.com/ugd/7ff653_4f0f0f0cdef54bd3908b1c070b463592.pdf
- https://static.usrfiles.com/ugd/cf14a4_61b99a4d970142c5b0d104c3a9bd91ae.pdf
- https://static.usrfiles.com/ugd/7e0eb0_4dc62f60e714429c94eb5fc767d98d47.pdf
- https://static.usrfiles.com/ugd/8e1900_60abed5b0a9040c2a97d9ec66d10ff74.pdf
- https://static.usrfiles.com/ugd/3b7182_4240c4729aca4a2194f9f8bb1fab931c.pdf
- https://static.usrfiles.com/ugd/38eac1_4eb54c75952d4136807cef73f0a8cfae.pdf
- https://static.usrfiles.com/ugd/b8c837_d63e9179ec9c4057915a8716084d9ae0.pdf
- https://static.usrfiles.com/ugd/bb4607_26669cd505734c3bb35f4475e270d56e.pdf
- https://static.usrfiles.com/ugd/13ae68_c2316b64bc7144aaa9f697a3a97af789.pdf
- https://static.usrfiles.com/ugd/6203b9_f04feea55405461f95b790473c65165e.pdf
- https://static.usrfiles.com/ugd/436160_0db79e9133fd4a729a73e12007b4af52.pdf
- https://static.usrfiles.com/ugd/4826f5_7dd2d857cf4b4e729af07ab18946ed3e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000580f.bin` `433d31ba05e8310fcf87103606a1eb2d5efd433ed372e99947a1854357446bbe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x580F	5076 bytes
`font_01_sfnt_off00006964.bin` `9692844b311bb8a333a4775c4361a1396365f987680711a9489204e642355d1d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6964	10388 bytes
`font_02_sfnt_off00008cf1.bin` `ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8CF1	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.