PDF malware analysis — malicious · f3ba35ac7b20b84c

MALICIOUS

PDF

47.4 KB Created: 2020-09-01 02:02:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ada32ffea16d62334bd56323bd3cb361 SHA-1: b46545d1ccfdc4f2a09bab51fd92beb7176481a3 SHA-256: f3ba35ac7b20b84c23ec10d10e795f6f8725fb08db14b294aa73d2162469f9d4

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, with a primary malicious redirector URL embedded in the document body. This URL, 'https://ttraff.cc/wix?keyword=lettering+practice+worksheet+for+dual+brush+pens', is designed to lure users to a malicious site under the guise of a worksheet. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=lettering+practice+worksheet+for+dual+brush+pens
- https://static.usrfiles.com/ugd/b8c837_1f2326bf082a4b47879fbc8d03a44528.pdf
- https://static.usrfiles.com/ugd/f4de5e_d1d3522197804168879957a4d4c67596.pdf
- https://static.usrfiles.com/ugd/e4a001_e9df8f615648403f94c8ba822d91a93e.pdf
- https://static.usrfiles.com/ugd/764aaa_47a04f997cd54c2db4a02e9953ad68cc.pdf
- https://static.usrfiles.com/ugd/3e9e83_a81cb20ca4b349d297d4126cfc7b8a28.pdf
- https://static.usrfiles.com/ugd/e3c460_5a6f6dae81954d61b4d0dc59d1aafc81.pdf
- https://static.usrfiles.com/ugd/b8c837_f998caf58f444d5c9ba04198824a294b.pdf
- https://static.usrfiles.com/ugd/b8c837_7fdb069ff4f04dcbb37ab1446f3308e2.pdf
- https://static.usrfiles.com/ugd/2f7815_c86d5e582e9f4219a346b7bc26552c28.pdf
- https://static.usrfiles.com/ugd/b8c837_e1ecea4fb2ef4005905eea90850c4860.pdf
- https://static.usrfiles.com/ugd/e78b77_95a8bac07f7849c3907bd8484d9c6a34.pdf
- https://static.usrfiles.com/ugd/12dc78_9f201edad7024d66a0b7410571fd3508.pdf
- https://static.usrfiles.com/ugd/735189_88eb8e327de24f76817b0d5cd57564f1.pdf
- https://static.usrfiles.com/ugd/f65518_955afa4143364d938b24c87ea4933b6f.pdf
- https://static.usrfiles.com/ugd/cafc24_61bb975d7f4c46d38463cb0a192b20c5.pdf
- https://static.usrfiles.com/ugd/576447_fbdddcc379584cb39326d812016ce806.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007a7f.bin` `5364db6a294b5e6b78e78a7f0920e0f1467cf22e1fba9984af5be005027bf698`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A7F	5652 bytes
`font_01_sfnt_off00008dc8.bin` `64292c00f0488ef5fd716996e15f8e4e9f94736553384c7e711c2fa49f8f73c7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DC8	10244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.