PDF malware analysis — malicious · 0b18fca5ad9f6c9f

MALICIOUS

PDF

48.7 KB Created: 2020-10-03 01:53:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ca0ea4bf7c4904247e804e882e74f940 SHA-1: 1a1b3e096bc91508c4878ca75d8f54d4c4f45216 SHA-256: 0b18fca5ad9f6c9f5f882026486409bf47766b6cc9f8eef658d6ee7628ac4ffa

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a link that redirects to known malicious infrastructure, indicating an attempt to deliver a payload. The document body and metadata suggest a lure for free PDF books, a common social engineering tactic. The ML classifier strongly flagged this PDF as malicious, and the presence of a redirector link confirms malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=quimica+inorganica+pdf+libros+gratis
- http://turuxob.mgss.com/uploads/1/3/0/7/130739344/dabagadogifovodip.pdf
- http://karav.karolynecronin.com/uploads/1/3/2/7/132712663/63f43da.pdf
- http://rovirozo.omerknoll.com/uploads/1/3/1/0/131069759/57a25e8fc8cf4.pdf
- https://site-1040179.mozfiles.com/files/1040179/lipegetodobopo.pdf
- https://site-1037245.mozfiles.com/files/1037245/movukekisiweforamaje.pdf
- https://site-1036637.mozfiles.com/files/1036637/bizorazexugeziga.pdf
- https://site-1039380.mozfiles.com/files/1039380/24604696782.pdf
- https://site-1040346.mozfiles.com/files/1040346/janekit.pdf
- https://site-1039852.mozfiles.com/files/1039852/zubixinemigajomoseza.pdf
- https://site-1036811.mozfiles.com/files/1036811/8593818979.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0438/4263/3890/files/compound_sentence_with_explanatory_statement_examples.pdf
- https://cdn.shopify.com/s/files/1/0435/4513/3207/files/60780974406.pdf
- https://cdn.shopify.com/s/files/1/0499/8361/9232/files/carl_r_rogers_on_becoming_a_person.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007e02.bin` `528c969a5d30154818027ee6b167ce893d25b9aa4a5f0d0dc578b70a8facf275`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E02	5676 bytes
`font_01_sfnt_off0000912f.bin` `9fc073f32ef67c7550a33bc8299086766bd0a06377616a20e897f14168f8cff6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x912F	11288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.