PDF malware analysis — malicious · f4647f97ae10d658

MALICIOUS

PDF

42.2 KB Created: 2020-08-30 16:26:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d6df3a8aa2664f91bed40dba8eaa786f SHA-1: 1b6d758cd1a4fadad2f80f0863f2f38e354e1554 SHA-256: f4647f97ae10d658d21db22732e0e88b32888be79c760548d013303d90257908

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged as malicious by a machine learning classifier and contains a link to a known malicious redirector, ttraff.cc. This redirector is likely used to obscure the final destination, which could be a phishing page or a malware download. The document body, though heavily obfuscated, contains the same URL, reinforcing its malicious intent. The presence of numerous other PDF links, many pointing to static.usrfiles.com, suggests a link farm or SEO poisoning attempt to drive traffic to the malicious redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=free+sunday+school+lessons+on+prayer
- https://static.usrfiles.com/ugd/87fdc7_d5d2a093fd3f404d8d2a615afd6b82c9.pdf
- https://static.usrfiles.com/ugd/b8c837_107ea472e23142c1ade4d378904ae83b.pdf
- https://static.usrfiles.com/ugd/b8c837_0430c70f4fc94b58b4a252bb469f3863.pdf
- https://cdn.shopify.com/s/files/1/0437/7418/1537/files/fipotojopudenepo.pdf
- https://static.usrfiles.com/ugd/fb83f1_ee021f4e82564a4c8b48495ed458ebc7.pdf
- https://static.usrfiles.com/ugd/b8c837_2fde680701e94438affd19eb660002ba.pdf
- https://static.usrfiles.com/ugd/b8c837_fea0591341f542bd962fe3f6fdc96c00.pdf
- https://static.usrfiles.com/ugd/6c032c_91046dec45644d429dd1993b0a257ce1.pdf
- https://static.usrfiles.com/ugd/b8c837_ba385a38c96a47f6959ba425c99e3d8d.pdf
- https://static.usrfiles.com/ugd/696b8a_c56f2232f61d4d8d8d87e0628a7ce8f2.pdf
- https://static.usrfiles.com/ugd/5be868_41364fbedf5f43d38a4b9e80d3e93688.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006828.bin` `19947388d3dab6859f49338d2b08866f1bb1ab2c1a3e6c125f42d2dc238e3662`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6828	5216 bytes
`font_01_sfnt_off000079e0.bin` `710fc7563cef36f10f3532293f440b2a1701663af470deb58f40229241d03d6b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x79E0	10156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.