PDF malware analysis — malicious · 3f1083bf585c2125

MALICIOUS

PDF

62.6 KB Created: 2020-10-28 11:15:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 15616f6d530fe412c2b12d7929304efb SHA-1: eff55d9a48cb6c0a82d70d992db49cbaecc278b3 SHA-256: 3f1083bf585c21259e63142cc8043ab46f740a05237bd27c364073bba9ac3c39

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains embedded links, one of which points to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://cctraff.ru/strik?keyword=a+love+to+last+july+21st', suggesting a phishing or redirection attempt. The presence of numerous other links, many pointing to S3 buckets with seemingly random filenames, indicates a link farm designed to obscure the malicious destination.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=a+love+to+last+july+21st In PDF document text
- https://cdn-cms.f-static.net/uploads/4389821/normal_5f8ddabb936da.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372384/normal_5f8e4c5f43ca2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388040/normal_5f8d3c775fe55.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/xenavuxa/technical_interview_questions_for_cse.pdfIn PDF document text
- https://s3.amazonaws.com/punurum/libreoffice_open.pdfIn PDF document text
- https://s3.amazonaws.com/zuxadol/fuboxuvopumetosif.pdfIn PDF document text
- https://s3.amazonaws.com/felasorarabipis/vodka_cocktail_recipes.pdfIn PDF document text
- https://s3.amazonaws.com/salosibejodod/azerbaijan_visa_application_form.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/1767/3636/files/note_taking_worksheet_electricity_section_1.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0506/6666/8230/files/colonizer_unlimited_apk_free_download.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0268/7808/3255/files/86372649560.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/2112/2211/files/tomb_of_menkaure_location.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/2991/4012/files/80485787574.pdfIn PDF document text
- https://s3.amazonaws.com/xafaxotaful/gmp_definition.pdfIn PDF document text
- https://s3.amazonaws.com/kisimujuk/fepiwe.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0268/8784/8121/files/79260029.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/9737/5388/files/salamat_full_song_wapking.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/4379/6645/files/social_security_office_albany_ga.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/vazaros.pdfIn PDF document text
- https://s3.amazonaws.com/wilugugo/autumn_leaves_partitura_para_guitarra.pdfIn PDF document text
- https://s3.amazonaws.com/lekizopiloref/bootstrap_glyphicons_list.pdfIn PDF document text
- https://s3.amazonaws.com/baxunaf/o_gato_preto_edgar_allan_poe_download.pdfIn PDF document text
- https://s3.amazonaws.com/memul/38706995460.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007edc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7EDC	17924 bytes
SHA-256: `1bce50e8827b09346ffb9a6f4bc061a2c833da1cfe855ed296cf0f7edf3e5341`
`font_01_sfnt_off0000b80d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB80D	4996 bytes
SHA-256: `4732d7bdba5f7bde93443c960fc487c3d46f668929bcfdec0e84890d2160d83b`
`font_02_sfnt_off0000c93a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC93A	10380 bytes
SHA-256: `14541f701a4d9974c6950dfd74f9e92b69159c834bb4920544b9c92ecccaf92c`

Open this report in the interactive analyzer, or submit your own file for analysis.