PDF malware analysis — malicious · 3b2d0d466d400ea8

MALICIOUS

PDF

79.4 KB Created: 2020-10-22 23:07:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: fdff8b5ab04e8c8cc9d9c952b14030e2 SHA-1: 7004fa0e9d83c241430cd9b4cf52c0f266450669 SHA-256: 3b2d0d466d400ea8b5c361af6a586cb37cc6c840903f16624c69e4ac8fde3f94

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with several pointing to known malicious redirectors and link farms. The document body, though heavily obfuscated, contains a URL that appears to be part of this malicious infrastructure. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/123?keyword=fcpx+brush+glow+apk+download In PDF document text
- https://sibakixode.weebly.com/uploads/1/3/2/8/132814768/fawinikaraba.pdfIn PDF document text
- https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/5142572.pdfIn PDF document text
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/9945460.pdfIn PDF document text
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/89cd5c9f44.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369327/normal_5f917596789a4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368248/normal_5f8d7e70ae091.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367624/normal_5f8926042c48d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388841/normal_5f91511459d2f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373304/normal_5f897b43248e8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385216/normal_5f8e0ad1c517b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366628/normal_5f87572fe20a3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368984/normal_5f89730616f27.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/742f9ca5-13dd-42ff-a146-a09fccb96615/59302714371.pdfIn PDF document text
- https://s3.amazonaws.com/rovikibixu/94733973274.pdfIn PDF document text
- https://s3.amazonaws.com/nezanurugega/miraxezidowuzetuzur.pdfIn PDF document text
- https://s3.amazonaws.com/gupuso/kotakigokopataxepobi.pdfIn PDF document text
- https://s3.amazonaws.com/jamokaroxoj/company_recommendation_letter_sample.pdfIn PDF document text
- https://s3.amazonaws.com/xanebavifamopez/nexatopawufuxabele.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/19a09509-a6e3-4f7c-91ba-7c08a4713278/zupitavudubad.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ad8a788-11a6-4a22-a300-4a74ca1b0ca0/mikedutoramavaxote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0492bea-29da-4792-9845-dba2a20b6b50/84001697771.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb7be639-28e8-4a92-989c-2fa96e161bbf/nanijuderenofanigevuzo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/091a14e9-4497-45fe-a304-59397ab0f03d/78215431914.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d2f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD2F5	5652 bytes
SHA-256: `120f97a9461f9656f66ee1502900f6d2fa8c5c968581077c1aeea755d8b6414a`
`font_01_sfnt_off0000e631.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE631	2672 bytes
SHA-256: `c03f138a07ce269aa7e26c4e83291533d566723cb3432a33c7b5c17ce92705ad`
`font_02_sfnt_off0000f1bb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF1BB	11464 bytes
SHA-256: `d0a94bed9054d9593dd36bde20244731ce769cbdd34a46be09cf42c5e7cf2400`
`font_03_sfnt_off00011909.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11909	16060 bytes
SHA-256: `0d2cf29b13ffe7e42e9984e6c191618c7dc34d08b3b68ffdc6e305960fb7475f`

Open this report in the interactive analyzer, or submit your own file for analysis.