PDF malware analysis — malicious · 2527cf7d355ee499

MALICIOUS

PDF

51.1 KB Created: 2020-10-26 09:06:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1689cc94fe7d4c726807d1bfd29cd178 SHA-1: 7c23d8812a3313f4d8cd840c28ce88c6b8984408 SHA-256: 2527cf7d355ee49912e477977e36698efffafe5aa8946a2180f65e162f067190

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with a critical heuristic identifying a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector. The presence of a large number of external PDF links suggests a link farm or SEO poisoning attempt, likely to obscure the malicious redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/123?keyword=aparato+digestivo+rumiantes+pdf
- https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/metutakis.pdf
- https://jamafijuzu.weebly.com/uploads/1/3/1/4/131437216/manisimixidedorafamo.pdf
- https://jikajulimag.weebly.com/uploads/1/3/4/3/134319013/xafisanabil.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/2697538.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f872c48c3f54.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f89413d63fdc.pdf
- https://cdn-cms.f-static.net/uploads/4377101/normal_5f8a19cda1618.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/037e476d-2661-46e8-afb5-b5d61e14ee8f/university_of_delaware_skating_club.pdf
- https://uploads.strikinglycdn.com/files/405a662d-6394-45f2-80d5-25c6ebf51d6f/kezemegepeketikulo.pdf
- https://uploads.strikinglycdn.com/files/f2ca80f9-7fad-4dd1-be12-66252fac1e68/vufodapusebonivowibog.pdf
- https://uploads.strikinglycdn.com/files/61134659-dbff-46a7-af66-0a4c8ee18eca/8707747877.pdf
- https://uploads.strikinglycdn.com/files/aeaa1067-9913-4e70-aa17-f9cc93fe29ce/61333383621.pdf
- https://uploads.strikinglycdn.com/files/cbc96003-99e7-4b64-9b11-7b38c9aec1d7/jojulom.pdf
- https://uploads.strikinglycdn.com/files/d59a4770-741a-493f-9cdc-c90269aaa11c/pavezu.pdf
- https://uploads.strikinglycdn.com/files/e2f95d30-0b89-4204-8749-0cd811d2c2fc/malefakisine.pdf
- https://uploads.strikinglycdn.com/files/1c110ad2-c4c2-41d6-8701-84f3bf82ef19/50273306626.pdf
- https://uploads.strikinglycdn.com/files/ea4c679d-a926-4105-8b20-7d23b7bedb5f/75364875822.pdf
- https://uploads.strikinglycdn.com/files/55c50809-aa6c-4055-83a7-4b5c61329ca2/24796884568.pdf
- https://uploads.strikinglycdn.com/files/c8c98e56-79ed-4c5a-b269-80eb887297b1/dezipik.pdf
- https://uploads.strikinglycdn.com/files/3acc55e2-550f-42fe-b010-b7da334a4b15/kudutefo.pdf
- https://uploads.strikinglycdn.com/files/21ccd72e-3e72-4d84-87e1-1e0c5928c65c/defamokuwanururobetubibov.pdf
- https://uploads.strikinglycdn.com/files/af25a616-4d88-49d2-99c3-097d094862ea/10751797081.pdf
- https://uploads.strikinglycdn.com/files/ad74e268-5a54-4b79-acdb-dbd88462993c/46974985417.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000774e.bin` `db1f6fb09f2d7fd36da80af6d4702912514cdbbc7c038499cba78b666e08cf6c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x774E	5260 bytes
`font_01_sfnt_off0000891f.bin` `03d3764e72d08557b559d90d82b70f22bb5722728ed3659caadeb80bb362b48a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x891F	11660 bytes
`font_02_sfnt_off0000aeb5.bin` `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAEB5	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.