PDF malware analysis — malicious · ec5c195407194415

MALICIOUS

PDF

58.5 KB Created: 2020-08-29 17:23:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9897d5820a675e96052a179758c99935 SHA-1: fb9096d82e64f31daf53d6e5229a7d96b906614d SHA-256: ec5c1954071944157ae39da774e32d35b16b7901cb25aeab15d178a549360230

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.com/wix?keyword=character+certificate+format+by+gazetted+officer+pdf'. This indicates the document's primary purpose is to redirect the user to a malicious site. The document body, though partially corrupted, contains the same URL and text suggesting a lure related to a 'character certificate format'. The presence of numerous external PDF links, many hosted on shopify.com, suggests a link farm or SEO poisoning tactic to increase visibility and clicks.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=character+certificate+format+by+gazetted+officer+pdf
- https://cdn.shopify.com/s/files/1/0430/8231/7978/files/fuzibejitiloreku.pdf
- https://cdn.shopify.com/s/files/1/0436/0005/2387/files/adjetivos_calificativos_en_ingles_para_describir_personas.pdf
- https://cdn.shopify.com/s/files/1/0430/7006/2754/files/78789404223.pdf
- https://cdn.shopify.com/s/files/1/0437/4321/5767/files/70980753417.pdf
- https://cdn.shopify.com/s/files/1/0460/2255/7855/files/adventist_hymnal_book.pdf
- https://cdn.shopify.com/s/files/1/0435/8540/5089/files/15053290489.pdf
- https://cdn.shopify.com/s/files/1/0440/1315/8565/files/armonias_cromaticas.pdf
- https://cdn.shopify.com/s/files/1/0463/3005/2769/files/dovuwozizavot.pdf
- https://static.usrfiles.com/ugd/99afdc_2ded550d314a42a1926d7f6fce4016b9.pdf
- https://static.usrfiles.com/ugd/b8c837_24aea0c63e874923a51c64b47926ef78.pdf
- https://cdn.shopify.com/s/files/1/0462/3604/1376/files/suxub.pdf
- https://cdn.shopify.com/s/files/1/0434/3706/4344/files/33357409502.pdf
- https://cdn.shopify.com/s/files/1/0428/9835/8432/files/37237973095.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009c43.bin` `85b692c1c636aed9ab1240d2a7361179fdd6c0849396a06064984f922e967b4f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9C43	2828 bytes
`font_01_sfnt_off0000a63d.bin` `9fd7712924aabff8c72cdcd04353427b7b8e2995093a57c6216f06af5cd3d2f0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA63D	5556 bytes
`font_02_sfnt_off0000b909.bin` `edd1f82efa9bf1bdc4efb561f8395dfb7ce9808c9fae57be87592237c9d48cf3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB909	10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.