PDF malware analysis — malicious · fe88c30b7c86b550

MALICIOUS

PDF

103.1 KB Created: 2020-09-02 10:05:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b7b7151877e7011e711a8cc09eff8a53 SHA-1: 9485f869b9fd1fdf2360caa1ac538a1d08b93868 SHA-256: fe88c30b7c86b550fc4306c520a30e451c49d9b0e0d1a2c1f8275c27beb1b3bd

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://ttraff.me/pify?keyword=famous+books+and+authors+list+pdf'. The document body, though heavily obfuscated, contains text related to 'Famous books and authors list pdf', suggesting a lure. The ML classifier also strongly indicated maliciousness. The primary attack pattern involves redirecting the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=famous+books+and+authors+list+pdf
- https://cdn.shopify.com/s/files/1/0436/4202/8182/files/bounce_dryer_sheets_mouse_deterrent.pdf
- https://cdn.shopify.com/s/files/1/0432/4117/7248/files/lavender_town_music.pdf
- https://cdn.shopify.com/s/files/1/0433/9941/3910/files/xavuliwosobufarurumapij.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/41326774972.pdf
- https://cdn.shopify.com/s/files/1/0435/3540/1111/files/similarities_of_administration_and_management.pdf
- https://cdn.shopify.com/s/files/1/0438/4319/0944/files/bugsy_malone_script.pdf
- https://cdn.shopify.com/s/files/1/0463/4869/7757/files/sewexefudazu.pdf
- https://cdn.shopify.com/s/files/1/0430/5072/9621/files/33150309456.pdf
- https://cdn.shopify.com/s/files/1/0431/0990/8637/files/vofajiwijisaw.pdf
- https://cdn.shopify.com/s/files/1/0431/6741/6488/files/wavasiwebomig.pdf
- https://cdn.shopify.com/s/files/1/0429/6530/3455/files/gelalekavewapasu.pdf
- https://cdn.shopify.com/s/files/1/0432/7247/0686/files/chelate_effect.pdf
- https://static.usrfiles.com/ugd/a4d998_054e4d141fe94cdda577d95369bca6de.pdf
- https://static.usrfiles.com/ugd/ae15ca_a7fad2df3fbe4ab3b27bd738b1e0fec4.pdf
- https://static.usrfiles.com/ugd/6846fe_97cfbbc3c47844209940b3e95eb9cc0d.pdf
- https://static.usrfiles.com/ugd/4cd51e_5b396b2eb02342d9999b3357acc6dad8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e029.bin` `dc232cb55889cc65eddcc06e499b9b478c6431ed97c514e027b119cc10d55eb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE029	38656 bytes
`font_01_sfnt_off00015857.bin` `52c1510d78fd2e74ba6721d79b502d131bfa2ed323fd677a217bf74d96460b13`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15857	5440 bytes
`font_02_sfnt_off00016aa9.bin` `b0f902341ba4002764f01976aed07398e29971be90a1dd9c10d6e7c258078a19`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16AA9	10588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.