PDF malware analysis — malicious · 1d62359fa2833580

MALICIOUS

PDF

35.7 KB Created: 2020-10-07 23:01:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23

MD5: da262518c9d5f05c407d0094062ecbd7 SHA-1: ea9327f87f81aa7f21e61b018e268b308b9dd49d SHA-256: 1d62359fa283358072690a4aeff74dc84881fd508d12f078e7d4dad4aa74cbd3

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a link to a known malicious redirector infrastructure. The ML classifier also flagged this PDF with high confidence. The embedded URL likely leads to a phishing or scam page, attempting to trick the user into providing sensitive information or engaging in fraudulent activity. No scripts were extracted, but the presence of a malicious link is sufficient evidence of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=wraith+spire+led+cpu+cooler In PDF document text
- https://site-1036958.mozfiles.com/files/1036958/10420889425.pdfIn PDF document text
- https://site-1042679.mozfiles.com/files/1042679/lemedejofatixirawepis.pdfIn PDF document text
- https://site-1037205.mozfiles.com/files/1037205/4413498658.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/869aaa12-2814-4139-a3b3-c8843279359f/netunogetuke.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c34dd0a5-1de5-4f76-8a83-7e0076908500/xodet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09dbe6e0-38fa-402c-bff6-41ba29c963d1/35023000193.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/828e8e1a-caed-4cde-8c5f-b0dcda564874/2909377827.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5efca24b-ea52-45a8-ad8c-bd7a23bd32d4/falafepulekoroligisixo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57a0fd28-dcc5-4fc7-b047-17a1ade852dd/25926440695.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/1457/6537/files/52502105106.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/5973/0839/files/muwosafefekukaw.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/1137/4230/files/celula_procariota_y_sus_partes.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/8030/9666/files/where_to_inject_igf_1_lr3.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/6678/4934/files/end_behavior_of_rational_functions_chart.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000051bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51BC	5176 bytes
SHA-256: `43953191e527f4110afacc02cf348bc1055f69de6408d025028e404922bbb547`
`font_01_sfnt_off00006359.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6359	9092 bytes
SHA-256: `d4031030e01adea0f74c0d403008731d77c51b7ca2968c0cf09170591680dcf9`

Open this report in the interactive analyzer, or submit your own file for analysis.