PDF malware analysis — malicious · 03870e378f517883

MALICIOUS

PDF

102.9 KB Created: 2020-09-06 10:12:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7cb971d0d0beb3b436bb6f131bbcf9bb SHA-1: 940a5ce478fd001aa7248dfa9543abe646e40667 SHA-256: 03870e378f517883159b0b38ff54dd5422decf2215736a474cc436dfc047c901

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text that appears to be a lure for movie subtitles, directing users to the malicious URL. The presence of many external PDF links suggests a link farm or SEO poisoning tactic to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9839

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/pify?keyword=film+maniac+2001+subtitle+indonesia
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fedorahosted.org/lohit
- http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102Hussain
- http://smc.org.inhttp://smc.org.in
- http://www.indictrans.org
- http://www.opentle.org
- https://cdn.shopify.com/s/files/1/0460/6561/5003/files/lokabuxur.pdf
- https://cdn.shopify.com/s/files/1/0437/5887/8881/files/schematic_design_estimate_guide.pdf
- https://cdn.shopify.com/s/files/1/0428/6713/0534/files/falanokumufipo.pdf
- https://cdn.shopify.com/s/files/1/0430/1894/4665/files/kadukofegurudaz.pdf
- https://static.usrfiles.com/ugd/23e9be_1e56356c76ae4dae92c1868468dd21e5.pdf
- https://static.usrfiles.com/ugd/771ea4_1431fdf58b80460c90aa425f0ccbdf76.pdf
- https://static.usrfiles.com/ugd/b42fd6_1b1248592ceb4c9da6f182d2fde12ce8.pdf
- https://static.usrfiles.com/ugd/b8c837_a7e816df90f84078a149fb3bc402d79b.pdf
- https://static.usrfiles.com/ugd/48d9a1_9b4fb8c368df475397425e493617ba60.pdf
- https://static.usrfiles.com/ugd/1ee69b_5175f7797d1146ddb97c52e0941fada5.pdf
- https://static.usrfiles.com/ugd/4dd980_6b05ed432e7a4916811bfec39cbb8b14.pdf
- https://static.usrfiles.com/ugd/1b8612_6216ec7cc97c492680f284063f3e6d4b.pdf
- https://static.usrfiles.com/ugd/b8c837_c52825cdeb7a4195b3b19cbfbc2a66c6.pdf
- https://static.usrfiles.com/ugd/f4de5e_415ff14a7b2e44179794ab326dca3ada.pdf
- https://static.usrfiles.com/ugd/dc98cc_01c4b18c1d9e44a4bbb3941040e2f79a.pdf
- https://static.usrfiles.com/ugd/681527_a7bbd2befbf54ca39e81db5365822553.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular
- https://gitlab.com/smc/meera/blob/master/COPYING
- http://sinhala.sourceforge.net/
- http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
- http://www.gnu.org/licenses/gpl-2.0.html
- http://www.gnu.org/licenses/gpl.html

Extracted artifacts 15

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_017_off00015994.bin` `ad63db25de4e7b269b2592bcd7525a98b526d2d753116db3c13cee84e8d0d93e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x15994	18892 bytes
`font_00_sfnt_off00008067.bin` `b6d8f72b59c47e884b0b6746a25c5cbd96eb494928042fd8f7d2b0ad088f297a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8067	7916 bytes
`font_01_sfnt_off000094c6.bin` `a849b76f9363f6e208a6b3b97826a54f7c8e554eb642b232eb64e54d4f8be3d6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x94C6	4032 bytes
`font_02_sfnt_off0000a337.bin` `19a45e450c3aa2a18e5bff5f4e53eb418036a5b3d41aa61dd9d4c913f1738c4c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA337	5412 bytes
`font_03_sfnt_off0000b583.bin` `1620336da6018abf771a3b64a4739dbc5cc5761e5bcfd31f9568e9163b5e6178`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB583	2656 bytes
`font_04_sfnt_off0000c088.bin` `b7882c459d94d9fb05ee491b72d0ee9c35e8d4bc9ed5787c7a0b3ba78fd6bc86`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC088	4140 bytes
`font_05_sfnt_off0000cda6.bin` `e23308bb06bff427f4fe2d795198e016b2e9db23d45fd702446b15ef1a1323d1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCDA6	3048 bytes
`font_06_sfnt_off0000d9b2.bin` `6d897259d7ab9db79b0dbb16904cd99ff486aa7f4a475590a5d3e44eab6e0eed`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD9B2	2328 bytes
`font_07_sfnt_off0000e46a.bin` `d4cda5a9ecb2558448f754249352cd4d73a8f7efff03060ee9a54ebf713292d1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE46A	2604 bytes
`font_08_sfnt_off0000ef45.bin` `869700f7b438b0b0f23cfbf3a170597ae1a6b01e9ba9f60fe7298d5eefb98f81`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF45	3840 bytes
`font_09_sfnt_off0000fd5b.bin` `b3976ad28991401f3a7e0d936621f3963ed8fd81aff5bedc9e25cf6548b1959b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD5B	2108 bytes
`font_10_sfnt_off00010739.bin` `87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10739	4336 bytes
`font_11_sfnt_off000114d9.bin` `0b38f6fd5e0b54bfa22d5adee1cfe00629fe134100fc7cfc1ad14a2ab7974207`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x114D9	6148 bytes
`font_12_sfnt_off000124c3.bin` `1f654659685327095100af7a83b4cdc398666ef68d933c4c01f9d956451625f8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x124C3	17036 bytes
`font_14_sfnt_off000178f0.bin` `1cc80836e0a54a2c4db1185994f1ac0eab94f7f28d8d60f500043b8ef5b5dd0a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x178F0	3536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.