PDF malware analysis — malicious · 0afcd1f2f0863b48

MALICIOUS

PDF

37.7 KB Created: 2020-09-02 13:13:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 85ba0c41c0967ca478262f8ef21fb1db SHA-1: 2ae6cd4ea29dd3abeeaa13c16f3886d424d36339 SHA-256: 0afcd1f2f0863b4855842ee4db47a4d4613b3023908077e855aa99ba56437786

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link disguised as a search result for 'hdpe plastic sheets menards', which redirects to a known malicious infrastructure. The presence of numerous other PDF links suggests a link farm or SEO poisoning attempt, aiming to drive traffic to malicious sites. The ML classifier strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/pify?keyword=hdpe+plastic+sheets+menards
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/e3834b_caea472198cf4688a5a9327fd93ac812.pdf
- https://static.usrfiles.com/ugd/bdeb4c_f4b0b95cb8b94fe2bbca3b62d8c4c591.pdf
- https://static.usrfiles.com/ugd/a8ca0f_31f698671870454a84882cc221b64b2a.pdf
- https://static.usrfiles.com/ugd/9a242c_3193eb94d2334c1c94e58978b5eabf3c.pdf
- https://static.usrfiles.com/ugd/b8c837_195e3f0534ea465ca49fba8be2f43f65.pdf
- https://static.usrfiles.com/ugd/9f6a24_3134ae5d478746a69139d73c0d95db6d.pdf
- https://static.usrfiles.com/ugd/b8c837_681d5d5fb3eb4682a5c791d1f1f60db0.pdf
- https://static.usrfiles.com/ugd/f515ca_fbab2d5d138d45a886c099d4402ee795.pdf
- https://static.usrfiles.com/ugd/f46427_6920f80d6a384bfaa7af34186a78ff60.pdf
- https://static.usrfiles.com/ugd/cece23_04225b8c3ebc4740956d86230031798d.pdf
- https://static.usrfiles.com/ugd/ce14f3_73373031939c42b6a26926dd70c20e40.pdf
- https://static.usrfiles.com/ugd/de3d83_22fa89d72d2f4cb6a0dd24b1b1114d2b.pdf
- https://static.usrfiles.com/ugd/87fdc7_fc265f7dfe1644eb94857620a9e515b1.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000049ca.bin` `3ae7a468cc1011bd47d7b6b2f18d552157a52fd18da8a88bbe2778808cfdbc0f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x49CA	5272 bytes
`font_01_sfnt_off00005b8a.bin` `fd35b84f6f16b8cc4a1f2b71f1a6e9017258522829c32f46375f69e05cdd7bc9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B8A	14524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.