PDF malware analysis — malicious · 0dd14284dbbda4b9

MALICIOUS

PDF

67.0 KB Created: 2020-10-12 08:03:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22

MD5: 362c79f5d414e6205ea647ae19c880f3 SHA-1: 5e27d048fd8235605ec76bf7740daa5c86b2eadd SHA-256: 0dd14284dbbda4b9303998ee70721305ec0eea56a818110731a441213a9821ca

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text related to a 'super mechs cheat table' and includes the malicious URL, suggesting a lure to a phishing or malware distribution site. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/pify?keyword=super+mechs+cheat+table In PDF document text
- http://files.escaypeent.com/uploads/1/3/0/8/130814219/ledalagevow.pdfIn PDF document text
- http://files.drylanddevelop.org/uploads/1/3/1/8/131871633/tifokaroz_kugasetisim_topefuzawit_xiravowutuv.pdfIn PDF document text
- http://files.pawtuxetvillageassociation.org/uploads/1/3/1/4/131409127/b43a1dfb70a.pdfIn PDF document text
- http://files.ppshowjumping.com/uploads/1/3/2/8/132814050/masebosunigiteg.pdfIn PDF document text
- http://mivar.panicoentertainment.com/uploads/1/3/2/7/132712663/5505361.pdfIn PDF document text
- http://files.virtualworxbusinesssolutions.net/uploads/1/3/0/7/130739727/64ff674.pdfIn PDF document text
- http://juwovu.kristinsmithcrowe.com/uploads/1/3/2/7/132712615/fewajanam-puraxil.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://uploads.strikinglycdn.com/files/f41baee3-fc6f-43d8-bd9b-72cebadcb2d4/70134769975.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b3b7e89-b9dd-4a98-bcb6-c19e28acfc16/83226250011.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8d5b3a6e-5b68-4df5-8aee-34095cafbe55/xufigekamivike.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/5666/0633/files/blacks_law_dictionary_10th_ed.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0483/0429/2004/files/2012_club_car_xrt_1550_parts_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/2659/1127/files/prisoner_b_3087.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/8348/8160/files/41588073868.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0487/0432/3734/files/36787245032.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007210.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7210	6312 bytes
SHA-256: `fdc44cf250acda686e5116a7982aca66ed055195f57e8caeb1d4607dc577f894`
`font_01_sfnt_off000087c0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x87C0	5416 bytes
SHA-256: `02d468b5add718350412f6eb1f99cc6a8a8b8686de9b6b5e285b99eddae3df5f`
`font_02_sfnt_off000099f3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x99F3	7716 bytes
SHA-256: `4d3abc82fcb56e60ebf335b8e34972518fdabe8b395792f5bf80b8c1b8632d2c`
`font_03_sfnt_off0000af23.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAF23	12548 bytes
SHA-256: `873d324a3daca3cdc3fb36ff3447bec372e212c8fce6786bc8c97cd08c245657`
`font_04_sfnt_off0000d942.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD942	16164 bytes
SHA-256: `849f621a87bdc7126faa108c334e7affc340b44f00d3efc1d220b1c647844df8`
`font_05_sfnt_off0000ee64.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE64	6144 bytes
SHA-256: `3b5ce330ca324811d5b110ed0ae8aee66d14f13d128b4eb8592a814691df3923`

Open this report in the interactive analyzer, or submit your own file for analysis.