PDF malware analysis — malicious · ff69e668f51ef8de

MALICIOUS

PDF

48.8 KB Created: 2020-08-29 08:28:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 05a71fb7bf05cdb0328be6e750ed0456 SHA-1: df3a5349ffc14f4c20f14658e612685771517b24 SHA-256: ff69e668f51ef8deb5b12ae7edf004648d5db6aed00e35c651b1454bc07fc84e

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The ML classifier also strongly indicated maliciousness. The embedded URL `https://ttraff.cc/wix?keyword=nissan+elgrand+owners+club+australia` is a primary indicator of malicious intent, likely serving as a redirector to a phishing or malware distribution site. The presence of numerous other links hosted on `static.usrfiles.com` further supports the link farm heuristic.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=nissan+elgrand+owners+club+australia
- https://static.usrfiles.com/ugd/b8c837_d387e0ed889c4da19f37f4ee07faba37.pdf
- https://static.usrfiles.com/ugd/b8c837_d31096489efc48f1ae5892255feb8075.pdf
- https://static.usrfiles.com/ugd/b8c837_0399333a34a74fe2886e000b8b12b952.pdf
- https://static.usrfiles.com/ugd/b8c837_c1a18a5a3042493ca7f82941cbdca950.pdf
- https://static.usrfiles.com/ugd/b8c837_c7dff08cdc934edf9583b34df90f6ec4.pdf
- https://static.usrfiles.com/ugd/b8c837_222e21fa17104e15808008453b568317.pdf
- https://static.usrfiles.com/ugd/b8c837_65373540caa0459fa6610c8336131adb.pdf
- https://static.usrfiles.com/ugd/b8c837_73f291fefe554f6cb4345bd5383cd736.pdf
- https://static.usrfiles.com/ugd/b8c837_60f03daf61db422c89e331811bd28e64.pdf
- https://cdn.shopify.com/s/files/1/0437/6772/6232/files/worksheet_personality_quiz.pdf
- https://cdn.shopify.com/s/files/1/0437/7391/9393/files/92544524157.pdf
- https://cdn.shopify.com/s/files/1/0431/1715/0368/files/ketapexezumi.pdf
- https://cdn.shopify.com/s/files/1/0437/3453/2245/files/koxekizoxemokasumeneduk.pdf
- https://cdn.shopify.com/s/files/1/0431/3789/2509/files/xegap.pdf
- https://static.usrfiles.com/ugd/b8c837_25f14091bed6462d88a10a8ec97254aa.pdf
- https://static.usrfiles.com/ugd/b8c837_8e274c87c17b4c05b8a8f33dbef06cbe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://static.usrfiles.com/ugd/b

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007f0d.bin` `14c26f6f0f9ab759f90992069084552c3e9557550aeb96a810ab75e0e6f4c973`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F0D	5308 bytes
`font_01_sfnt_off0000912d.bin` `1302122ea0f89da1a1cec3d44c6d15a2f059705f8d013706dac1013f46477042`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x912D	10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.