PDF malware analysis — malicious · 05c4f1504c94bb5d

MALICIOUS

PDF

40.7 KB Created: 2020-10-04 21:28:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b674087c67d9b6a75d2d56a15200fff0 SHA-1: c1f44f1a0af4ce9e277a91f6e28c75a5b5e47d70 SHA-256: 05c4f1504c94bb5d362e092fd11f3b4e58e2fc1670f9e2ecc2b62c7cedf14f48

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is a common tactic for credential harvesting or malware delivery. The heuristic 'SE_MFA_LURE' further suggests that the document is designed to trick users into providing sensitive information, such as one-time codes or MFA approvals. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a malicious intent to redirect the user to a potentially harmful site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=romeo+and+juliet+act+5+questions
- https://site-1037911.mozfiles.com/files/1037911/51861687866.pdf
- https://site-1043691.mozfiles.com/files/1043691/48282007669.pdf
- https://site-1036728.mozfiles.com/files/1036728/wujapa.pdf
- https://site-1038700.mozfiles.com/files/1038700/71525891315.pdf
- https://site-1037224.mozfiles.com/files/1037224/sozokiwowarid.pdf
- http://files.backstageatthebeach.com/uploads/1/3/1/3/131379939/gamizukowazewe_nubatatu_bafolofosezol.pdf
- http://files.catholicworcester.org/uploads/1/3/1/6/131606212/dovovisur-tubizimigile-nubun-zadik.pdf
- http://files.nancynetherland.com/uploads/1/3/2/6/132695302/5821577.pdf
- http://files.thomaslupton.com/uploads/1/3/1/0/131070894/0f53aee910404.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/072c10e1-2d27-413f-88c6-f2a7a62b3e5c/busisopejipo.pdf
- https://uploads.strikinglycdn.com/files/fa468822-9d19-4c0a-ad8b-348c777ca628/36316613899.pdf
- https://uploads.strikinglycdn.com/files/b3b5dc21-614f-4e16-8cbe-8e53262cf496/25619633730.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000060f0.bin` `25084220d14222ca412847172ccbe3517f420dcfc8d7690d099a6e44dbbb3494`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x60F0	5320 bytes
`font_01_sfnt_off00007303.bin` `8a18e49f3731394a5d7dff12d0be0bffb05507ca556b5039ed126f9d0844683f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7303	10412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.