PDF malware analysis — malicious · eeb3dd1374290be8

MALICIOUS

PDF

38.6 KB Created: 2020-08-30 12:12:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a9f7d4b7776c49fd951811dca180755f SHA-1: 4bb98392e4fc735e90aaa5aa0247f10712d48f7e SHA-256: eeb3dd1374290be8699f0951fbaceab9222652350173443323ef135d5f2f78db

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.club/wix?keyword=configure+tp+link+router+to+access+p'. This, combined with a high ML score and the presence of a mass external PDF link farm, strongly suggests a phishing or redirection attack. The document body, though heavily obfuscated, contains the same suspicious URL, reinforcing the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=configure+tp+link+router+to+access+p
- https://static.usrfiles.com/ugd/0a593f_78ceee5b45b1496f9cfe5d3b5ac9396e.pdf
- https://static.usrfiles.com/ugd/b13fd1_721a475fadcb4b119fdbfca54849a573.pdf
- https://static.usrfiles.com/ugd/d54300_4dde9aa1aae44c738b1939e2c35bd697.pdf
- https://static.usrfiles.com/ugd/b8c837_7d862d8c369b475b88e180046f18280d.pdf
- https://static.usrfiles.com/ugd/b8c837_0a32f71df2c1490b8a6deff2a4a70521.pdf
- https://cdn.shopify.com/s/files/1/0437/6245/0586/files/garalabadufefuxubaw.pdf
- https://cdn.shopify.com/s/files/1/0428/8118/8003/files/zokinosawawopugisiniga.pdf
- https://cdn.shopify.com/s/files/1/0428/5385/9494/files/54631217498.pdf
- https://cdn.shopify.com/s/files/1/0430/9689/9733/files/wumukob.pdf
- https://cdn.shopify.com/s/files/1/0431/0863/0681/files/xurazufazesaxofaz.pdf
- https://cdn.shopify.com/s/files/1/0441/2270/1976/files/kawalumumokidozevixupa.pdf
- https://cdn.shopify.com/s/files/1/0428/2764/5084/files/15171709098.pdf
- https://cdn.shopify.com/s/files/1/0435/6849/6798/files/mijudowukosu.pdf
- https://cdn.shopify.com/s/files/1/0449/4046/0200/files/assamese_book_file_download.pdf
- https://cdn.shopify.com/s/files/1/0429/3092/9827/files/89330671363.pdf
- https://cdn.shopify.com/s/files/1/0431/2127/9137/files/nivozega.pdf
- https://cdn.shopify.com/s/files/1/0432/8924/7894/files/zopetifuwes.pdf
- https://cdn.shopify.com/s/files/1/0433/8250/5628/files/aberrant_behaviour_checklist.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005a01.bin` `cd9e1666551bef74015ed3330db3d38ad28c4b81482e99b07e5095f3872ab709`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5A01	5152 bytes
`font_01_sfnt_off00006b9c.bin` `d16b9213fd028e3898b5d87536f89cc1d278b10d8f054a16467bf57c0c6f1143`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B9C	9852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.