PDF malware analysis — malicious · 2aba9a338a841d3e

MALICIOUS

PDF

40.0 KB Created: 2020-09-03 00:57:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0b639ce416b11d683bdb34b5992df268 SHA-1: 20d6fbd1b59fabd29ae3c17d75615b94d932cc7f SHA-256: 2aba9a338a841d3e69852be7dcabfcc8f7726bbb8a484dd3e7a880359eecad7f

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a heuristic firing for a malicious redirector link, which is also present in the document body. The document body itself contains the text 'Formato cdr abrir' and multiple URLs, suggesting a lure to open a file. The presence of a large number of external PDF links further indicates a link farm, a common tactic for SEO poisoning or redirecting users to malicious sites. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=formato+cdr+abrir
- https://static.usrfiles.com/ugd/46429b_8cbc65fc35c744fe87581ae98878d957.pdf
- https://static.usrfiles.com/ugd/b8c837_12c70df8f6874c928cbe2bf06766e928.pdf
- https://static.usrfiles.com/ugd/b8c837_4dd1d581fa7e47719c9a1f79b245599e.pdf
- https://cdn.shopify.com/s/files/1/0432/2770/9597/files/76369734080.pdf
- https://cdn.shopify.com/s/files/1/0432/3934/2248/files/karowudejepugibewaw.pdf
- https://cdn.shopify.com/s/files/1/0434/5787/2033/files/lavutosesitasodowasiziju.pdf
- https://static.usrfiles.com/ugd/913720_7b038c59671b4360a039cbf635b61dfc.pdf
- https://static.usrfiles.com/ugd/9e53d4_963b3d68948d43c4831f49ff1667d9d8.pdf
- https://static.usrfiles.com/ugd/5c139a_9c9ba1953b4e4c2aaafb4ff46767b5c9.pdf
- https://static.usrfiles.com/ugd/b8c837_681d5d5fb3eb4682a5c791d1f1f60db0.pdf
- https://static.usrfiles.com/ugd/e32576_333b52c1c1f84bfe91068963a0c880c6.pdf
- https://static.usrfiles.com/ugd/b8c837_9d6ac805ccef4705aeed88c6bf67e36f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005b93.bin` `07205d9a01769eccdd912d34793cabad35e5d111e6aba97412a3b16f709f0b31`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B93	4972 bytes
`font_01_sfnt_off00006c5d.bin` `95f37d577517685ea79243fb417a8baa64781017dca6f7bb4a2439bb3012f49d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C5D	12624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.