PDF malware analysis — malicious · 0662f1707f0be3b6

MALICIOUS

PDF

54.7 KB Created: 2020-10-27 01:47:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8cc6f5469bb932ab9fb71eef511676c2 SHA-1: 13fe6ba3ff3f290ecb98cd1598ca9d9329015029 SHA-256: 0662f1707f0be3b6d0e58ca83622f3f0be369a0d4012ba5b4ca113ac5fda3c29

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://ttraff.ru/123?keyword=marx+german+ideology+pdf', is flagged as a malicious redirector. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the document structure and embedded links are indicative of a malicious lure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/123?keyword=marx+german+ideology+pdf
- https://xujaxivef.weebly.com/uploads/1/3/1/4/131438557/rubizavetasa_bumojumi.pdf
- https://wivupenoremew.weebly.com/uploads/1/3/0/7/130775018/7fb0f735660291c.pdf
- https://gidixelasulam.weebly.com/uploads/1/3/0/7/130739099/4464003.pdf
- https://rabugotekinevod.weebly.com/uploads/1/3/1/8/131871666/9539637.pdf
- https://vimefipivarek.weebly.com/uploads/1/3/4/3/134310944/68ade3d9d4.pdf
- https://xexogabowagub.weebly.com/uploads/1/3/4/4/134438270/linuxuwepevok.pdf
- https://benukozememig.weebly.com/uploads/1/3/4/4/134480731/nepotogajobebatubeg.pdf
- https://ranerenonosojib.weebly.com/uploads/1/3/1/4/131483420/2771956.pdf
- https://cdn-cms.f-static.net/uploads/4369331/normal_5f8828d5f3dc5.pdf
- https://cdn-cms.f-static.net/uploads/4386822/normal_5f8d1c29b0998.pdf
- https://cdn-cms.f-static.net/uploads/4379032/normal_5f8cce6e419ae.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/rebomedug/kotevejav.pdf
- https://s3.amazonaws.com/golepe/the_thirsty_crow_short_story_in_english_with_moral.pdf
- https://s3.amazonaws.com/xanebavifamopez/income_tax_amendments_for_ay_2019_20_icai.pdf
- https://s3.amazonaws.com/leteraxewe/cricket_score_sheet_for_6_overs_download.pdf
- https://s3.amazonaws.com/dutimajizowa/cost_accounting_notes_in_hindi.pdf
- https://s3.amazonaws.com/kezemiradigu/spatial_data_model_in_gis.pdf
- https://s3.amazonaws.com/purixifusipelid/acquisitions_incorporated_sourcebook.pdf
- https://s3.amazonaws.com/fulosobezur/78524050585.pdf
- https://s3.amazonaws.com/levumoduf/moral_dilemma_questions.pdf
- https://uploads.strikinglycdn.com/files/1b679cee-82e0-47e7-9b6e-85da786fdcbc/65440435290.pdf
- https://uploads.strikinglycdn.com/files/73f51261-103c-46b0-bb05-6cf799dfec19/58102563899.pdf
- https://uploads.strikinglycdn.com/files/8be11207-adcb-416c-b310-40353b79cfd5/xegobewuronijat.pdf
- https://uploads.strikinglycdn.com/files/7a552f07-39b9-4003-8583-e3af99878256/ruvopadenafeperupame.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009833.bin` `a54eb112246bee64981d9501a443baeb091fe6cee6e90ec6779cb7228518ff8c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9833	5360 bytes
`font_01_sfnt_off0000aa6d.bin` `fd8218831509cb2cd462992ef2ff373d70cd782f96771bf01726ea245dd183da`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA6D	10064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.