PDF malware analysis — malicious · 15f8d323f60adc4b

MALICIOUS

PDF

34.2 KB Created: 2020-09-02 13:55:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 38f863dbccd54ec2292a7db1c4b2480d SHA-1: 6861cad8bf9c81069e261d9c7fdab984666b4374 SHA-256: 15f8d323f60adc4b1603d6bfe72f3908961d5818ecf04fffa363bba57dc35594

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, 'https://ttraff.me/wix?keyword=car+racing+game++apk+3d', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains keywords related to 'car racing game apk 3d' and the malicious URL, suggesting a lure to download potentially harmful software. The presence of numerous other PDF links, many pointing to benign content, indicates a link farm strategy, but the critical heuristic firing on the redirector is the primary concern.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=car+racing+game++apk+3d
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/9734e7_35b78053b422480e9f484d69d07b5ec3.pdf
- https://static.usrfiles.com/ugd/cb4a18_5d53ab682e1f48a7871f7c480a9a742f.pdf
- https://static.usrfiles.com/ugd/1d64af_14e6b80ef9a748d79b05d2d5ae5fdc81.pdf
- https://static.usrfiles.com/ugd/1c90dc_2181922165424fccbf10ce3f240b8027.pdf
- https://static.usrfiles.com/ugd/b8c837_33906e7b17164d1da9613f6d42afb0ce.pdf
- https://static.usrfiles.com/ugd/b8c837_9badf7fb0ffd40e79498412c81767ac0.pdf
- https://static.usrfiles.com/ugd/078c79_12832ada7e7648aba8bca2fb4c596a49.pdf
- https://static.usrfiles.com/ugd/b8c837_f48536f7208c499baacd5fd2431ace0c.pdf
- https://static.usrfiles.com/ugd/b8c837_0564db30819642d980ce7fa014338bad.pdf
- https://cdn.shopify.com/s/files/1/0435/5630/7107/files/tudutu.pdf
- https://cdn.shopify.com/s/files/1/0432/5572/6238/files/kiwil.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000493d.bin` `d7bfe82f95402c13292668f9c44d0edc2ae8b5241f1189e06b75013ad88291df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x493D	5316 bytes
`font_01_sfnt_off00005b40.bin` `0bdff7195c60983832dd09be522dee01478404b6bbc33c710165a3295a366adc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B40	9792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.