PDF malware analysis — malicious · 1feed744c55e4182

MALICIOUS

PDF

54.2 KB Created: 2020-09-06 11:40:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 5553ecae2762131cfb4d044378e3bc2f SHA-1: 0bd6f1b300e0b0c22b4fb2a84973c2d74d5e27ab SHA-256: 1feed744c55e4182044ba7f074c8f2ca634a6f2c03dca43c0eaefe1c090d8cd2

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, masquerading as a movie download lure. The primary link, https://ttraff.link/wix?keyword=tamil+latest+movies++free+hd, is identified as a malicious redirector. The document's structure and numerous external links suggest it is part of a link farm designed to drive traffic to malicious sites, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=tamil+latest+movies++free+hd In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://static.usrfiles.com/ugd/10b11f_97537ddd474748f0970e7b133a42469c.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_121881e543384f23b0e857600fcdb254.pdfIn PDF document text
- https://static.usrfiles.com/ugd/9ced5d_66da7484a5a840eb99e68e5e26b785dd.pdfIn PDF document text
- https://static.usrfiles.com/ugd/39a0fd_dac5b633ade44c81abeefbbe4221df4d.pdfIn PDF document text
- https://static.usrfiles.com/ugd/7198c1_3d456f60254b475b8b1ccacf1ed5f068.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/5524/2655/files/continuity_equation_in_cylindrical_coordinates.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/2758/6457/files/53352534040.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0450/3132/5846/files/bupusininadawu.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/7896/7703/files/riwewibejijovokales.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0460/0404/3935/files/budidaya_artemia.pdfIn PDF document text
- https://static.usrfiles.com/ugd/6290de_e78b53f663944ca0ab1d6c2c7801021f.pdfIn PDF document text
- https://static.usrfiles.com/ugd/80c1db_7e1623a1bb0341d98a15e2bdf9910db9.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_acf7e84155ca4fe594712a62d09d1253.pdfIn PDF document text
- https://static.usrfiles.com/ugd/296484_c6ff6e79961d4567912e50c85eedb2d3.pdfIn PDF document text
- https://static.usrfiles.com/ugd/97634b_4db7fa94f37b4889abc4da69197c8021.pdfIn PDF document text
- https://static.usrfiles.com/ugd/d54300_50a55ac2f76d46e5a12db368652a0eeb.pdfIn PDF document text
- https://static.usrfiles.com/ugd/dad90e_42edf566ca2f4611b2ec27d7d3a6e3f0.pdfIn PDF document text
- https://static.usrfiles.com/ugd/221f3a_f7ccd03a89b54353ba5b9b4432f54978.pdfIn PDF document text
- https://static.usrfiles.com/ugd/4dbf3f_ad2d83d0a0a54abeaf866947340c34fc.pdfIn PDF document text
- https://static.usrfiles.com/ugd/0789d5_0701e2d039ec42af929ffee757f91487.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000071de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71DE	4840 bytes
SHA-256: `605e07bda3d7e257620a82ad4377bf4141ea4e65f7a42d21e745b50bf44229a6`
`font_01_sfnt_off00008256.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8256	10548 bytes
SHA-256: `ddb6aaea2be51531c9424b4b09b24ed10381ab5bb46ae3dc20a0a32949b47269`
`font_02_sfnt_off0000a699.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA699	16164 bytes
SHA-256: `c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e`
`font_03_sfnt_off0000bbae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBBAE	4324 bytes
SHA-256: `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`

Open this report in the interactive analyzer, or submit your own file for analysis.