PDF malware analysis — malicious · ed04dca1f5f46022

MALICIOUS

PDF

42.8 KB Created: 2020-09-06 09:15:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: adf834b1cb80f93406359dcbbc5c3744 SHA-1: 306e1dc4b5dd6c2647d6f9f909aedf88e8d56870 SHA-256: ed04dca1f5f46022feb4870628735fd9632219a18a6f19b335755e6e81ab035e

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/pify?keyword=create+airbnb+guidebook'. This URL is presented within the document body, suggesting a social engineering lure to trick users into clicking it. The PDF also exhibits characteristics of a link farm, with numerous embedded URLs, many pointing to static.usrfiles.com. The ML classifier also flagged this PDF with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=create+airbnb+guidebook
- https://static.usrfiles.com/ugd/ce77c6_e12ed431ac4744eeb8fba91b433a0561.pdf
- https://static.usrfiles.com/ugd/49f5ef_2c889ecfffd24ed8a4d54b7fa0189dd9.pdf
- https://static.usrfiles.com/ugd/b8c837_91436a01911e49eab3aeec83c749f18e.pdf
- https://static.usrfiles.com/ugd/2c8d66_84ec8862fe1541f8b0d282b4eec3825c.pdf
- https://static.usrfiles.com/ugd/b8c837_4f72e0e0602e47d79c0122bc21420125.pdf
- https://static.usrfiles.com/ugd/b8c837_33284a30091f4077a062a2edbcfe5c9e.pdf
- https://static.usrfiles.com/ugd/debbe1_24f53c0e45de4629bdea5b2cf0c09f06.pdf
- https://static.usrfiles.com/ugd/52b593_8619274a8b644c4cbc510318ddeb51b4.pdf
- https://cdn.shopify.com/s/files/1/0436/9501/4056/files/didarisatur.pdf
- https://cdn.shopify.com/s/files/1/0437/1503/5291/files/78040203135.pdf
- https://cdn.shopify.com/s/files/1/0433/8316/0995/files/test_de_autolesion.pdf
- https://cdn.shopify.com/s/files/1/0429/1792/0934/files/pabusabipu.pdf
- https://cdn.shopify.com/s/files/1/0437/0412/3557/files/atls_american_college_of_surgeons.pdf
- https://static.usrfiles.com/ugd/5926b4_66021b7ea103457ebfdad37d09074ded.pdf
- https://static.usrfiles.com/ugd/9f2514_d03a48aea94e4268b84f14aeb301b3ef.pdf
- https://static.usrfiles.com/ugd/338562_7adf0b12d3dd4e308ae9426dd724ff1c.pdf
- https://static.usrfiles.com/ugd/9b33c5_8143c596e1b942f7bbde5a4cce475d89.pdf
- https://static.usrfiles.com/ugd/086daf_fe5ed55147644d08be34f6d66fc7d83e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a41.bin` `7a7cb2dd4951a19785c0c26d19d82587cd246c4d0776431d18505a73d2144bc3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A41	4892 bytes
`font_01_sfnt_off00007aeb.bin` `99ea269876adc38da6c4c4771fdb5f9431a306cba18636cf026da9fa7c3e20d3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7AEB	10428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.