PDF malware analysis — malicious · 3b11cfbacd3ca7e4

MALICIOUS

PDF

40.6 KB Created: 2020-10-26 17:41:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: d6f40acff0b9611d66a5e0b9ae56b32b SHA-1: 46f150fff3a1b7eba577d456f13d8c2f5782d101 SHA-256: 3b11cfbacd3ca7e4ec48b4475bddcb6bc68c7b42408906522ee09940ec507338

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is designed to phish users by disguising malicious content as educational material. The ML classifier strongly indicated maliciousness, and the PDF structure itself points to a redirector link. No scripts were extracted, but the primary malicious function is the redirection to a potentially harmful URL.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=introduccion+a+la+pedagogia+social In PDF document text
- https://cdn-cms.f-static.net/uploads/4369771/normal_5f8863ff700f4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366364/normal_5f8767e46b1b9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f8734826d43c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f8947a995ce4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372719/normal_5f8b8ea3ef098.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366980/normal_5f874f82ae27c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372382/normal_5f8a1b15989ef.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372399/normal_5f8e4b7ab8ae1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405929/normal_5f924dcc3e9de.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367635/normal_5f876c17782f3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373782/normal_5f8c42589c50c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378605/normal_5f8b7607cad1c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368759/normal_5f8fb49d2cbe5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374181/normal_5f8f94c67c815.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403556/normal_5f92376142154.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383698/normal_5f91a40f5f8b1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392873/normal_5f90529a67619.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366659/normal_5f87300e82600.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/lulelepese/73366689899.pdfIn PDF document text
- https://s3.amazonaws.com/wonoti/folabikovodapuvomabepuv.pdfIn PDF document text
- https://s3.amazonaws.com/gewuwasi/boeing_747_specs.pdfIn PDF document text
- https://s3.amazonaws.com/fefurorobumi/physical_and_cognitive_development_in_adolescence.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dfc5b4a8-a7b4-4d21-be7f-97cfbed179c7/vojusebokun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32ea3db0-2154-45c3-9953-7425d4d6d747/zulefo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81399cd3-ecec-4d39-a0b5-cc76b5f34bb2/74413700640.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005da6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5DA6	5180 bytes
SHA-256: `33ea118b33fa98fa6fc36934f524ff1e2393227721c17d980b424841913381b0`
`font_01_sfnt_off00006f4d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F4D	10816 bytes
SHA-256: `fe33e3da68ed6f1896f204bdadc7751d7dd92fd7afc7d9efdb5b2bc3dd6b7937`

Open this report in the interactive analyzer, or submit your own file for analysis.