PDF malware analysis — malicious · f910865886efa031

MALICIOUS

PDF

35.7 KB Created: 2020-08-29 18:02:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0f13923af5dd9a2589ae894cf7765627 SHA-1: 454a03cef65d17005a96a52157d22263d8e05665 SHA-256: f910865886efa031cefa76c3abec2afa8844db7b6951dc6d67f5812e080582ed

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.ru'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs, many hosted on Shopify. The primary malicious URL is likely used to redirect users to a malicious site for phishing or malware delivery. No scripts were extracted, limiting further analysis of the execution chain.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=pb+ng+hilesi+2016
- https://cdn.shopify.com/s/files/1/0450/5898/2040/files/synonyms_all_words.pdf
- https://cdn.shopify.com/s/files/1/0434/3539/3191/files/vibexi.pdf
- https://cdn.shopify.com/s/files/1/0436/3023/1712/files/98260455593.pdf
- https://cdn.shopify.com/s/files/1/0429/2745/6419/files/poulan_chainsaw_fuel_line_routing_diagram.pdf
- https://static.usrfiles.com/ugd/b65acf_2b36f426a4d640808a4ea9b507e31161.pdf
- https://static.usrfiles.com/ugd/b65acf_ccd282a14d474d57bd466c96124f462e.pdf
- https://static.usrfiles.com/ugd/b8c837_f47ab693e40c4d2d8411d679fbc148b2.pdf
- https://static.usrfiles.com/ugd/b8c837_36283b5091dc4a1d81b45ae716907607.pdf
- https://static.usrfiles.com/ugd/b8c837_ba9188eb68da4c28af3d092a9df1644b.pdf
- https://cdn.shopify.com/s/files/1/0440/3275/3829/files/51283664576.pdf
- https://cdn.shopify.com/s/files/1/0432/4717/3800/files/genesis_chapter_summaries.pdf
- https://cdn.shopify.com/s/files/1/0435/7629/5592/files/the_first_noel_phil_wickham_chords.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004d33.bin` `cefb02bd25ae8c48e9425bc1c75c306e54f22f3b0caa48199869c09d8d7b2cce`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4D33	5260 bytes
`font_01_sfnt_off00005f1c.bin` `76294793cd142438137132f0955c037efa4e85fca30bb49a01f7c865237e1577`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F1C	10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.