PDF malware analysis — malicious · 159f8edfe2cf4dba

MALICIOUS

PDF

49.0 KB Created: 2020-08-30 15:03:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9cda6be151c74e6ffa640cc3eb992f6b SHA-1: 71c6cbf2c40a16cea43dedea5a01ea6d0bdd984e SHA-256: 159f8edfe2cf4dba0d59230985429d62cb5bdfb9cb1e98153ad56631bdc37d71

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to 'ttraff.com' which is flagged as a malicious redirector. The document body, though heavily obfuscated, contains the same URL and a keyword related to hacking Wi-Fi, suggesting a lure for malicious content. The presence of numerous links to external PDFs, many of which are benign, indicates a potential SEO link farm used to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=aplikasi+bobol+wifi+wpa+android+tanpa+root
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/3bca44_aae0811d43294e08b33bcf6191a9212a.pdf
- https://static.usrfiles.com/ugd/b8c837_2d77f2b57c8a43fd8b1c7c0d218342df.pdf
- https://static.usrfiles.com/ugd/b8c837_68dae51147b445c292a74ae76c6722d4.pdf
- https://static.usrfiles.com/ugd/ed64d2_f5c2f1ef5c3f4ef3ba5cc42d6ce53c7f.pdf
- https://static.usrfiles.com/ugd/0a052f_f333f5cf9d7b426da598d54b102e14c5.pdf
- https://static.usrfiles.com/ugd/bae363_d6c0f6c06eaf47fb89d3b9e7c85c734f.pdf
- https://cdn.shopify.com/s/files/1/0437/6326/9789/files/rewofatunevesixuxokedu.pdf
- https://cdn.shopify.com/s/files/1/0430/3978/5111/files/2ez_table_2016.pdf
- https://static.usrfiles.com/ugd/b8c837_7ba1d084c5234a77990e9413f8821f85.pdf
- https://static.usrfiles.com/ugd/45fd81_69e3c15259c44be38e25300a575b6d93.pdf
- https://static.usrfiles.com/ugd/b8c837_6b4c1f4e04f04d0da469195ffab11cca.pdf
- https://static.usrfiles.com/ugd/9ff9b8_643c5159cd8a41c192586ba8990c02b8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007fba.bin` `ec637926dcf3c05aaf50ac18c424f7c8b42d04627b4ef7392b19b2b9793d89ca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7FBA	5320 bytes
`font_01_sfnt_off000091e0.bin` `057164bc0cd9728a7c5e20d542138effd33cbc45008b75f55b2fc353aee855c3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x91E0	10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.