PDF malware analysis — malicious · 26d9745eb577342c

MALICIOUS

PDF

45.3 KB Created: 2020-08-31 02:12:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fcec1cc88e6672cb3bd0641cc8afb204 SHA-1: 2e66ce3de59c4b28148e355ba3991ab0ee1ed58f SHA-256: 26d9745eb577342c35de43ba2cdbdfe2303fb92d1b8dbc790e8e5108b0338bc3

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged as malicious due to a critical heuristic indicating it contains a redirector link to known malicious infrastructure. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded URLs pointing to external PDF files. The primary malicious URL identified is https://ttraff.com/wix?keyword=issa+case+study+steve+rogers, which is likely used to redirect users to a malicious site. The document body contains garbled text and a reference to the malicious URL, suggesting it is a lure.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=issa+case+study+steve+rogers
- https://static.usrfiles.com/ugd/b8c837_b97a0e3b72dc47ab8d3b8cce4610559d.pdf
- https://static.usrfiles.com/ugd/a48928_cb022d9da2be4a3184bfc93f509384d3.pdf
- https://static.usrfiles.com/ugd/760101_2ceaa6a413044aae97d4ba2db15bcaea.pdf
- https://static.usrfiles.com/ugd/99a8f2_dd42a943c69f488d9d5abd696e6ca81e.pdf
- https://static.usrfiles.com/ugd/b8c837_17210462a724451698488763164e7bf8.pdf
- https://static.usrfiles.com/ugd/ae15ca_f590056ef62a4475adb122c472206eac.pdf
- https://static.usrfiles.com/ugd/e3ff21_bdcd345858ce41c8bec66905fb9ceed4.pdf
- https://static.usrfiles.com/ugd/cf14a4_cfd224a33f8d4d5a84f363a725cd27e0.pdf
- https://static.usrfiles.com/ugd/d1d005_3d47e513a16e4cfcac36c9400bd11f1d.pdf
- https://static.usrfiles.com/ugd/83b1b3_d9a826e00057455988cc10cecd2f4a6d.pdf
- https://static.usrfiles.com/ugd/9f6a24_8db136f8514d4a49ae8a53fbd7a9109e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007324.bin` `d7928cad569d450e396539a09941e2699d15cb6753eace7963a399eff9f709d4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7324	5176 bytes
`font_01_sfnt_off000084cc.bin` `d43331ca6d64a1b4607a28cefb710cbe5bc15aa12b062a0b0c4cc2e87674ee1e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x84CC	10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.