PDF malware analysis — malicious · f16ae2505b7af472

MALICIOUS

PDF

356.2 KB Created: 2020-09-01 09:23:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b07199dc7bfa53d4a8aabf4f4d7bf24e SHA-1: 1eee5214c8f46f3c7977237ffa4b0a762b07daf5 SHA-256: f16ae2505b7af472d95f2bf64786a5aa744f4c781e5947f007fdce50b3762cac

90 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing indicating a malicious redirector link. The ML classifier also strongly flagged this PDF as malicious. The embedded URL, https://ttraff.ru/wix?keyword=esc+pocket+guidelines+myocardial+revascularization, is the primary indicator of malicious intent, likely serving as a lure for phishing or malware delivery. No scripts were extracted, but the PDF structure and the malicious URL are sufficient for a high-confidence assessment.

Machine Learning

Nyx PDF Classifier malicious score 0.9987

Heuristics 2

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=esc+pocket+guidelines+myocardial+revascularization
- https://static.usrfiles.com/ugd/b8c837_bd2509dd60c8478d80cab159c50a1e43.pdf
- https://static.usrfiles.com/ugd/de3d83_88af8e1aa2104703af93a57cf7a4f963.pdf
- https://static.usrfiles.com/ugd/cf14a4_29e5b4ff045e49a9b0e449405560d04d.pdf
- https://static.usrfiles.com/ugd/b8c837_c0baa625869d476482b5754e6ae6e8d8.pdf
- https://static.usrfiles.com/ugd/76156b_5c4346f01d2346deabc8d22a8d88932a.pdf
- https://static.usrfiles.com/ugd/2f07a1_015e70664bd54ed2945f4c8c3dd87aba.pdf
- https://static.usrfiles.com/ugd/32acb1_df96c2d7d81b49938092c2202c0e2132.pdf
- https://static.usrfiles.com/ugd/b8c837_321509018dc64367ae7f55a15431404a.pdf
- https://static.usrfiles.com/ugd/b8c837_053808e8de0a4b62b6f65f7f8946bbac.pdf
- https://static.usrfiles.com/ugd/b8c837_133699766a68417d99bdd95685438f55.pdf
- https://static.usrfiles.com/ugd/b8c837_417c0ff001e2497caa8b57bf0fc4ca53.pdf
- https://static.usrfiles.com/ugd/76de1a_b892aa6c94df4e2899ac13c8bfcfd90d.pdf
- https://static.usrfiles.com/ugd/b8c837_3eb302010e414e41a3cf82b8467ae960.pdf
- https://static.usrfiles.com/ugd/10e3af_03c69414d50e47808928c566c4ed7e2e.pdf
- https://static.usrfiles.com/ugd/b8c837_47290f84890a4e0d8e292dde9666bc21.pdf
- https://static.usrfiles.com/ugd/b8c837_fd358eb5139245329059b49ec75e6d3d.pdf
- https://static.usrfiles.com/ugd/b8c837_adf11f39feff487e8b7240dbf7e34420.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0005254a.bin` `e714bdd8c62113e98103f7d535bf20fce870aefb33fe0a94d23fb1fc3cc0ed2d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5254A	5624 bytes
`font_01_sfnt_off00053870.bin` `fb864f9d20e1e28bc45b2f36ef4d9ae841f72592fe72379f7233f1352892d578`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x53870	16532 bytes
`font_02_sfnt_off00056bd0.bin` `8be69302d4e45fe85c9fab78dc6d96cf410d6213fddef079043d254261a79733`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x56BD0	16176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.