PDF malware analysis — malicious · 10250425b023b334

MALICIOUS

PDF

37.6 KB Created: 2020-08-30 02:33:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f95ec0bd689b7ae48129bf14fe72f5a4 SHA-1: 09a84337cf87e474b4188c6a2fc72c5c8aec83e3 SHA-256: 10250425b023b3345e4877dc69aa62ad472a6562abce99eaad69122a7c8cf9ce

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, https://ttraff.com/wix?keyword=ginuwine+pony+free+mp3+download, is flagged as a malicious redirector. The document body, though heavily obfuscated, contains text related to MP3 downloads, suggesting a lure. The presence of numerous other PDF links indicates a link farm strategy, likely to distribute malicious content or engage in SEO manipulation. The ML classifier strongly indicates maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=ginuwine+pony+free+mp3+download
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/4dd980_f062fbcc771b4f79a46be50eb9e8f5ba.pdf
- https://static.usrfiles.com/ugd/bb13a2_0f407fcb719e428197165d23aa2da794.pdf
- https://static.usrfiles.com/ugd/b8c837_ae99941970e0485da10f56d4a04bda7d.pdf
- https://static.usrfiles.com/ugd/e5a943_151b758323ec4ae7994714f9a71555af.pdf
- https://static.usrfiles.com/ugd/5b9365_2d005ba84d224bbfbb2cddb4ca560209.pdf
- https://static.usrfiles.com/ugd/b8c837_b469bbfbb92b47b990690137d1cb885f.pdf
- https://static.usrfiles.com/ugd/71fd01_b78fef337126405d9437a0d1fad27351.pdf
- https://static.usrfiles.com/ugd/b8c837_c158ba2cfbc04189b35daf60ae48f1cc.pdf
- https://static.usrfiles.com/ugd/74c34a_5b68ce9a885f4cd798d1016029b1e78b.pdf
- https://static.usrfiles.com/ugd/b8c837_5d05a729c1dd4c169673ba417321a4ac.pdf
- https://static.usrfiles.com/ugd/b8c837_04d9a5dc6c114c009b489c546dfeb623.pdf
- https://static.usrfiles.com/ugd/3aee12_7d505df1ae7540479a5dd590274345f3.pdf
- https://static.usrfiles.com/ugd/b8c837_06a290a14c7b4918819c938994945933.pdf
- https://static.usrfiles.com/ugd/b8c837_abdc432b46884b95948ced4d2c913206.pdf
- https://static.usrfiles.com/ugd/b8c837_74a5ce99115d458bb9fffb5bc40a766f.pdf
- https://static.usrfiles.com/ugd/455f95_03f8126e18d34cbfa5e05ee83a88b6fb.pdf
- https://static.usrfiles.com/ugd/b8c837_bafe44b636f941a88a8734836f0c4a9c.pdf
- https://static.usrfiles.com/ugd/a59130_60e416d2920c49e4b9a16eae19b8854a.pdf
- https://static.usrfiles.com/ugd/2b25b5_4a73dbb101474aa894437922a31f0401.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005294.bin` `2904fe54e5a69061ac71542605c68d012e9dbc8d913999d22c9b6582ea98446d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5294	5400 bytes
`font_01_sfnt_off000064fc.bin` `a984f5da5af4538a6cc2e05d9dedacbd05f8274a3d1b466c707264f4ea89e437`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64FC	11016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.