PDF malware analysis — malicious · 0a46478a435a829f

MALICIOUS

PDF

61.4 KB Created: 2020-11-02 15:57:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: da0d49398329c45e2f6c31fa2d6f769d SHA-1: b2478a70421326523b652e7533c554fafe8fe653 SHA-256: 0a46478a435a829fcb70e25886dc4c96f751a97eb7f452a2ba8a1113389250b5

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://ttraff.club/123?keyword=methylene+chloride+in+water'. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL within the document body indicates an attempt to lure the user to a harmful site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/123?keyword=methylene+chloride+in+water
- https://cdn-cms.f-static.net/uploads/4378386/normal_5f948a80ae0bc.pdf
- https://zalawevovupat.weebly.com/uploads/1/3/0/9/130969727/5666024.pdf
- https://cdn-cms.f-static.net/uploads/4377391/normal_5f8f2aae53364.pdf
- https://cdn-cms.f-static.net/uploads/4387420/normal_5f94278376065.pdf
- https://cdn-cms.f-static.net/uploads/4367277/normal_5f89c503c4811.pdf
- https://cdn-cms.f-static.net/uploads/4407789/normal_5f9cf5bfba4f4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/6f28dd20-71cb-40f7-b71d-8fa8434fbb43/lectrofan_micro_manual.pdf
- https://cdn.shopify.com/s/files/1/0500/5082/6426/files/xogefabixasoginita.pdf
- https://uploads.strikinglycdn.com/files/2c306c27-53bc-4d15-8564-f9b734909f70/65385137846.pdf
- https://s3.amazonaws.com/vavale/3109766042.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00009027.bin` `0acae127d432746d095b5bd0375a0897f34f14d5dd3edc903598d39ab18e2e5d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9027	6492 bytes
`font_01_sfnt_off0000a05b.bin` `311de308184fd20f6f3d3518025091bd524d87edeaebe5414b025b575ce626ca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA05B	4836 bytes
`font_02_sfnt_off0000b0ce.bin` `ce634431a197d7067bf3b7a7cf7786d5965b0b814f312fc192c6591a72c92944`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB0CE	12560 bytes
`font_03_sfnt_off0000da6c.bin` `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDA6C	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.