PDF malware analysis — malicious · 409842989ff92493

MALICIOUS

PDF

47.7 KB Created: 2020-09-07 02:52:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 29325cebe4419f1fc7d82d7cfcd20c45 SHA-1: 1f797127ebb228e175fe1153ed3c1005a3fe43e9 SHA-256: 409842989ff92493e652db1d7e5f486f6c54984e25f63f5f85f855fd7c33d4a6

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a critical heuristic firing indicating a malicious redirector link. The embedded URL 'https://ttraff.me/wix?keyword=reformed+baptist+seminaries' is likely the initial lure. The document also contains a large number of external PDF links, suggesting a link farm or SEO poisoning attempt. No scripts were extracted, but the presence of a malicious redirector strongly suggests a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=reformed+baptist+seminaries
- https://static.usrfiles.com/ugd/7f46b5_503cad58c91b4586b033ef225ab36f4e.pdf
- https://static.usrfiles.com/ugd/902d29_0fb1ea4ce69d4cdb8c0debca67707dee.pdf
- https://static.usrfiles.com/ugd/a43ec6_7b485854aea6489fb9d475944559fc29.pdf
- https://static.usrfiles.com/ugd/4479ed_7251df3019dd4a3186b6ed14c6f5d6ce.pdf
- https://static.usrfiles.com/ugd/7e84b7_ffbc12f955db4bebac9d13d1aedaef43.pdf
- https://static.usrfiles.com/ugd/07ef24_937b8fa6aadf4b7fb6a73808e1e65871.pdf
- https://static.usrfiles.com/ugd/b8c837_63709972f7bb491fa0b25fc2089647cc.pdf
- https://cdn.shopify.com/s/files/1/0428/1974/7996/files/guvonora.pdf
- https://cdn.shopify.com/s/files/1/0430/1268/5977/files/zesumig.pdf
- https://cdn.shopify.com/s/files/1/0433/5727/4261/files/76516477099.pdf
- https://cdn.shopify.com/s/files/1/0430/9798/1089/files/2752279231.pdf
- https://static.usrfiles.com/ugd/90c678_d089936df08141bf89a1e3932065f30f.pdf
- https://static.usrfiles.com/ugd/39a0fd_201df5c150f4411395370fd4b9ff4de0.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000711c.bin` `245e1e87dfc71042ba991572217ba83b7518a49e3d7a7f67862917524c20f626`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x711C	5304 bytes
`font_01_sfnt_off00008308.bin` `c34e318de26e0d823ee628547d9c1a94deb75723dbd9811798ad315f5029e811`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8308	15168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.