PDF malware analysis — malicious · 05e7887d6a9ddc98

MALICIOUS

PDF

40.5 KB Created: 2020-08-30 01:56:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 84fb7b9010817a7b7e4c91b98fb7c196 SHA-1: 4afd5036a4230d3e7d1fb6f228465b295a6ac248 SHA-256: 05e7887d6a9ddc9876013a8f30b8803020a030af591fc60758b219d68c842f88

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains a URL suggesting a lure for free movie downloads. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or redirection attack.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=movie+free+mp4
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/b8c837_5d8a81fd402b450e8f1908aa6c252875.pdf
- https://static.usrfiles.com/ugd/0286dd_7603e3a07dc54c0a9ad483257f80fe8c.pdf
- https://static.usrfiles.com/ugd/b8c837_0b3745ad81a549aa8d7920947b94713a.pdf
- https://static.usrfiles.com/ugd/b8c837_179fd8786ac64f2db5de0ab89a31cd27.pdf
- https://static.usrfiles.com/ugd/b8c837_fe0b654dd6f3450fa4922c0acb5911b7.pdf
- https://static.usrfiles.com/ugd/544c7e_b784dc905c214f2fa04cbbf19f39581a.pdf
- https://static.usrfiles.com/ugd/d5d855_d63cfe3274f84812bc47ffd7ac7a2315.pdf
- https://static.usrfiles.com/ugd/136d07_cd1e734558c14a0ea6150ea4e5a37f8a.pdf
- https://static.usrfiles.com/ugd/314c35_766d430d0abc470483db6eac57ae2801.pdf
- https://static.usrfiles.com/ugd/b8c837_f17c6554e1ce4a27b2ea7a8688aa29ca.pdf
- https://static.usrfiles.com/ugd/b8c837_8614395f95f14a9492019aaa4f76754e.pdf
- https://static.usrfiles.com/ugd/b8c837_6d3ea8f85497471ab7e4afc10ab067ea.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000061ea.bin` `3eef0621a084f0817e41b956e0c2e84c2c41af5403a61dc075661ba88bd7682e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61EA	4780 bytes
`font_01_sfnt_off00007232.bin` `d8a24fb1f25d704ee17f728e88a03b6b456d5775a49b67b17dce82e17fa5f191`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7232	10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.