PDF malware analysis — malicious · fc0875280f308726

MALICIOUS

PDF

49.2 KB Created: 2020-09-06 14:23:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 010b69d7418f1bf269d7d1666f1b7d05 SHA-1: 05ff0c93f24aee2e07b67302f0d054b89ec72054 SHA-256: fc0875280f3087260b863b8d4234c539ecc4adef906022d4611633cc79b2ca4a

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a malicious redirector link disguised as a furniture website template. This link, 'https://ttraff.ru/wix?keyword=furniture+website+template+bootstrap', is designed to lead users to malicious infrastructure. The ML classifier strongly indicates maliciousness, and the PDF structure suggests a lure to external content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=furniture+website+template+bootstrap
- https://static.usrfiles.com/ugd/ceb2e8_68140ca587f6471cb66eb39f621322fe.pdf
- https://static.usrfiles.com/ugd/760a88_f1e317588dcf4ea7a3e738a88193ce6c.pdf
- https://static.usrfiles.com/ugd/cf5aa9_215a45b7d6184f1da5bbef3d37659f30.pdf
- https://static.usrfiles.com/ugd/baef12_2fe151ee6ca443c0905f9e4c3074f657.pdf
- https://static.usrfiles.com/ugd/3db607_29b890f4139749719add4e271202be32.pdf
- https://static.usrfiles.com/ugd/735424_306e829ca67c461f9e1708e0af970d2f.pdf
- https://static.usrfiles.com/ugd/cf5aa9_f8bcb53acebe4c23ad003e7067182158.pdf
- https://static.usrfiles.com/ugd/98d639_10a4a9b6cb314d6d96c3ff0025cdbdca.pdf
- https://static.usrfiles.com/ugd/d17951_da07d39292984a558cfc76e1fa4ea25b.pdf
- https://static.usrfiles.com/ugd/ade4e6_d9f3b7e60ef84d8dacaf3d53416c0c86.pdf
- https://static.usrfiles.com/ugd/c81504_1ab2d294e54b4a418f6bf0e87c62f941.pdf
- https://static.usrfiles.com/ugd/e2c6c1_a755ae79222846fe8430bd545f47d3db.pdf
- https://static.usrfiles.com/ugd/15cd4d_5ddafb97990c4915befcb0c2b589f1c7.pdf
- https://static.usrfiles.com/ugd/e2f197_b7071bd6edf84d2b9196170956eb85fd.pdf
- https://static.usrfiles.com/ugd/87d215_93b18d0a0172489f982647528485ad8a.pdf
- https://static.usrfiles.com/ugd/112488_2902e5974fa14576b23b09de4d5fe454.pdf
- https://static.usrfiles.com/ugd/3283b0_f2d4c80c53b54f11b8300737ba968bee.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008432.bin` `ceebe38f515ad96ebf976821986f588db0f80a15938fd67975bc6761abbd0fb6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8432	5152 bytes
`font_01_sfnt_off000095ac.bin` `ddb7ec922bd12aa7c033d988ce7997e0ea557ea67aea7abc2816700a3ab3572d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x95AC	9876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.