PDF malware analysis — malicious · eb91b945db312442

MALICIOUS

PDF

44.8 KB Created: 2020-08-29 14:15:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9a477d38259ce6da4664147616062270 SHA-1: 1032b1622f49a1e741fe2cd03534a73462a713ba SHA-256: eb91b945db31244262e4ac7dad2e1e530eba89188d7b82fec2f31fd2bf18576d

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, with a critical heuristic firing indicating a malicious redirector link to 'https://ttraff.com/wix?keyword=i+heard+the+owl+call+my+name'. The document body, though heavily obfuscated, also contains this URL and numerous other links hosted on 'static.usrfiles.com', suggesting a link farm or redirection strategy. The primary intent appears to be directing users to malicious infrastructure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=i+heard+the+owl+call+my+name
- https://static.usrfiles.com/ugd/b8c837_e035f19bee364caeadc848be57b77a97.pdf
- https://static.usrfiles.com/ugd/b8c837_c89056227e6f45a3a5d8eed9a9e47951.pdf
- https://static.usrfiles.com/ugd/b8c837_9a1b85329e56487085f77b286c4c3d0d.pdf
- https://static.usrfiles.com/ugd/b8c837_6263b29036f743c0a76294c39c240abd.pdf
- https://static.usrfiles.com/ugd/b8c837_1779f72805b5484d8595fa4a2d796370.pdf
- https://static.usrfiles.com/ugd/565485_b6ef417bd0054eb3979002d206bcad16.pdf
- https://static.usrfiles.com/ugd/b8c837_feea9c8c46c14084a1ed97d141a35646.pdf
- https://static.usrfiles.com/ugd/b8c837_7a7bfa148a58420d9e372c99d0b7c051.pdf
- https://static.usrfiles.com/ugd/b8c837_1638111e37bd4c80b3b30bbc8a6ccb82.pdf
- https://static.usrfiles.com/ugd/b8c837_d7b4058e02c947d09a2cf0f90eecc184.pdf
- https://static.usrfiles.com/ugd/b8c837_f6870e46963c409fb85b4320f2f66eb2.pdf
- https://cdn.shopify.com/s/files/1/0433/7768/8743/files/66984877537.pdf
- https://cdn.shopify.com/s/files/1/0432/5376/0160/files/58865425234.pdf
- https://cdn.shopify.com/s/files/1/0430/3519/7602/files/21588825234.pdf
- https://cdn.shopify.com/s/files/1/0440/1646/8133/files/godesonagatowokolegev.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006569.bin` `55b21db65d3ab8f09a510176e279ff0545e6992b0a46bb85a027d8d4af7988fd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6569	4872 bytes
`font_01_sfnt_off000075da.bin` `45911de26d2d3268fb8c1764153a4d798b9e5dc8e01dd136f75f4d35d391c2bf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x75DA	10040 bytes
`font_02_sfnt_off00009840.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9840	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.