PDF malware analysis — malicious · 24cc53762c9db7b8

MALICIOUS

PDF

41.4 KB Created: 2020-09-01 17:47:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f7e6ed2a8559f48f46219057ad6518be SHA-1: 85f4042de00949b0f08c098dd7e92ce6849c1d0d SHA-256: 24cc53762c9db7b85a44441da3d8e5435b9b17ba80490610cc89dfa2e8066789

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The ML classifier also flagged this PDF as malicious. The document body, though heavily obfuscated, contains the URL https://ttraff.com/wix?keyword=amenaza+definicion+pdf, which is a known malicious redirector. The presence of numerous links suggests a link farm or phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=amenaza+definicion+pdf
- https://static.usrfiles.com/ugd/b8c837_52551db70c754f599b83e9b3a7d13f27.pdf
- https://static.usrfiles.com/ugd/b8c837_6fab0fb2f8284ee8a177317f2dddbf43.pdf
- https://static.usrfiles.com/ugd/b77b08_5ef934e12e71411f803f91ddf9a1f227.pdf
- https://static.usrfiles.com/ugd/b52961_d4a3fd03083b4ae295bf9419938a8f86.pdf
- https://static.usrfiles.com/ugd/dad90e_12d6f925789c4ed383fd6a2e724b0cc5.pdf
- https://static.usrfiles.com/ugd/909b15_8e08a94929164fc2baedf6e8bf45f82d.pdf
- https://static.usrfiles.com/ugd/361045_97fb685097664d33b32d5cbdfdbd916b.pdf
- https://cdn.shopify.com/s/files/1/0430/6649/1042/files/22168435089.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/42632515291.pdf
- https://cdn.shopify.com/s/files/1/0432/7827/0619/files/78292719970.pdf
- https://cdn.shopify.com/s/files/1/0432/6470/4662/files/bapakukefudukumorel.pdf
- https://static.usrfiles.com/ugd/b91566_ef8c156a484f4c4aa2d45c515b7c09dd.pdf
- https://static.usrfiles.com/ugd/b8c837_645c089ac308464b8c1b746283966581.pdf
- https://static.usrfiles.com/ugd/b8c837_841b51e9e56641518f1ee9788556fad4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000624e.bin` `42bab3d795d177ae1f9cfeb50fd5edd5e3ca4c836c7999c4c3a78c9cbe1a213d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x624E	5032 bytes
`font_01_sfnt_off0000736b.bin` `7c41de7d5ca9d02a3a0935855eb5ce4d560f6bd62977faaa42d7c023d1948981`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x736B	11064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.