PDF malware analysis — malicious · 0fb6d24797e3e693

MALICIOUS

PDF

34.8 KB Created: 2020-09-01 04:25:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e79423f02af01c29d45700f5aa0ad3c7 SHA-1: b3a409141a133048f514f3488fbbc79534cff862 SHA-256: 0fb6d24797e3e69341a009ca7406a271812390f5696a0c116b7e8be084e1339a

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to a link farm designed for SEO manipulation. One prominent link redirects to a malicious URL, likely serving as a lure for users searching for 'chegg answers free hack 2019'. The document's structure and embedded links suggest an attempt to drive traffic to malicious or spam-related content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=chegg+answers+free+hack+2019
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/fbccce_74eeba281f7e4edb915554f47f3bc482.pdf
- https://static.usrfiles.com/ugd/cc15ef_e7972f78669e4f7890b861a51f0f6992.pdf
- https://static.usrfiles.com/ugd/c1615c_4e5c17504f8b4ba6a7eed623fa968789.pdf
- https://static.usrfiles.com/ugd/b8c837_113ebf78a3324752a355d55de411a222.pdf
- https://static.usrfiles.com/ugd/b8c837_33e26a5e05e44935a143d4af544fb78c.pdf
- https://static.usrfiles.com/ugd/79e0dc_c388beb3d0dd419da85582d5fb21fcaa.pdf
- https://static.usrfiles.com/ugd/b8c837_538721c2a6c542a3807f4fcdeba1b002.pdf
- https://static.usrfiles.com/ugd/b8c837_0c8cd3e0f1784a58ab2cea819706dd8a.pdf
- https://static.usrfiles.com/ugd/b8c837_d1f77c90893a4412aaa3473ad3b14f38.pdf
- https://static.usrfiles.com/ugd/3e9e83_f2ce8daed01848e29dca6020eb440860.pdf
- https://static.usrfiles.com/ugd/b8c837_da0534fc26834392a6891e7b16b012dc.pdf
- https://static.usrfiles.com/ugd/4b68be_45f672ce4972410c81fae2c80a424b9e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000046fc.bin` `1ddc236f3524dd4616131ce699cabb0a0cc8b299906f8fbb2dfcdb1e7d2e56d3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46FC	5656 bytes
`font_01_sfnt_off00005a50.bin` `9ffba6ec32c3960decf372d37c774a871b54fd1bea7b4110eb2c7794b5f91d45`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5A50	11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.