PDF malware analysis — malicious · e9c3b380cee19bd7

MALICIOUS

PDF

59.1 KB Created: 2020-09-03 13:46:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9e787900452d1065754e355997c24ea3 SHA-1: e17bd8e7fd58c85f0eca04cf917b9da19f2f2e22 SHA-256: e9c3b380cee19bd7598594b323753220e6e1ba6da74040e8e1b80cb0bf6c3134

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=cool+runnings+imdb+parents+guide'. This URL is embedded within the document body, disguised as a movie guide. The presence of a large number of external PDF links, many pointing to static.usrfiles.com, suggests a link farm or SEO poisoning technique to obscure the malicious destination. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=cool+runnings+imdb+parents+guide
- https://static.usrfiles.com/ugd/2813e2_a387412548694ae397adbfeb9e9d923e.pdf
- https://static.usrfiles.com/ugd/b8c837_70daa1f1fdf1455cbc981c6cfc1217fe.pdf
- https://static.usrfiles.com/ugd/2e4eb4_c2b3e770eecf4cf5bb299cd1755e5db2.pdf
- https://static.usrfiles.com/ugd/b8c837_acc0d9c00c1646f6ac83b160b2d77bd1.pdf
- https://static.usrfiles.com/ugd/b9801a_7529baa446824ed88ba2e286f2c3b84e.pdf
- https://static.usrfiles.com/ugd/b8c837_f17c6554e1ce4a27b2ea7a8688aa29ca.pdf
- https://static.usrfiles.com/ugd/35ddae_00248fc4ebb14da5a38fc6b849159e1d.pdf
- https://static.usrfiles.com/ugd/9f69bd_a278c5c352f04249ba0b92f509333555.pdf
- https://static.usrfiles.com/ugd/bf650e_69480ba712654c69b989f4af72273a10.pdf
- https://cdn.shopify.com/s/files/1/0434/0570/5374/files/fallout_tactics_strategy_guide.pdf
- https://cdn.shopify.com/s/files/1/0431/3631/9645/files/24152117116.pdf
- https://cdn.shopify.com/s/files/1/0437/1392/1175/files/31470051493.pdf
- https://cdn.shopify.com/s/files/1/0432/4127/5547/files/38736694306.pdf
- https://cdn.shopify.com/s/files/1/0432/5860/9817/files/xudenetarezobimarerejuwe.pdf
- https://static.usrfiles.com/ugd/cf79db_c2da4333a29b42a0ac75092529ff80ad.pdf
- https://static.usrfiles.com/ugd/5ea691_6938a1130e1048a2a1b421daf75e53aa.pdf
- https://static.usrfiles.com/ugd/b8c837_9babca9598b14045ad3889e6a2fec3ae.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ab04.bin` `bfda4371cd48cce33eb58feda3f35b6268731d1c89f75ea7c22ff11ed8fab57b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAB04	5324 bytes
`font_01_sfnt_off0000bcf7.bin` `29a415e1e6b097adb7e556cf81864d18f7e9abba8e090b2ff1b8ca45056c87f5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBCF7	10120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.