PDF malware analysis — malicious · 3cd5f9a3cc0358c7

MALICIOUS

PDF

49.7 KB Created: 2020-11-05 08:44:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16

MD5: ed3cbe5807bba3972bbba7a92e731c17 SHA-1: 9b32b0a18fc197852b789f55aaedd4e0cbf84bb4 SHA-256: 3cd5f9a3cc0358c79f87200c752f91285a8b44b4a86efc86cddf95f45c8c3c71

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by an ML classifier and contains a link to known malicious redirector infrastructure. The embedded URL, 'https://ttraff.link/123?keyword=canon+xl2+manual', is presented in a way that suggests it is a search result for a manual, likely to trick the user into clicking it. No scripts were extracted, but the presence of the malicious URL is a strong indicator of a phishing or redirection attack.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/123?keyword=canon+xl2+manual In PDF document text
- https://cdn-cms.f-static.net/uploads/4381536/normal_5f9a3ee5bac19.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376869/normal_5f8d4f0ea9c29.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381762/normal_5f9b63f76f907.pdfIn PDF document text
- https://vilewufatavak.weebly.com/uploads/1/3/4/5/134585542/9210820.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408858/normal_5f9fa85a2e90e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f93051032d16.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380073/normal_5fa39231266a8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392463/normal_5f906e9f99b2a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6c1baea2-2469-45c4-8935-91c4bfaabb13/buvapegagej.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0ed7779a-a738-4090-a1ab-30c2b1f0b17e/majonefira.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007b45.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B45	4664 bytes
SHA-256: `1b762cb2e8d286795e9570ad6bec3e192f868266c37e9a3fcd4577077d7eee41`
`font_01_sfnt_off00008b0f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B0F	15396 bytes
SHA-256: `150d5dcad39b3ee3b5f262823ade79ab73d27f64eb8c40275489c3756fde017c`

Open this report in the interactive analyzer, or submit your own file for analysis.