PDF malware analysis — malicious · 454386df8bb78eda

MALICIOUS

PDF

39.2 KB Created: 2020-08-20 04:33:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 37bd7fa6329a71a6a2c5defdc1568ba9 SHA-1: 153dcbde9ec4b3c6d8833a3ac5ef5553fae12a15 SHA-256: 454386df8bb78eda9ec9a45ef91d28ee7003fbe0b555ccbc9afa7e8ceab07ec7

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, many of which point to Shopify domains hosting other PDFs, but one critical link directs to a known malicious redirector. The ML classifier also flagged this PDF with high confidence. The primary attack pattern involves a link farm designed to obscure the malicious redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=avatar+java+jar+game
- http://xurobe.leapaheadcenter.com/uploads/1/3/0/7/130775606/nukiriwili.pdf
- http://files.saintcatherineorthodoxchurch.org/uploads/1/3/1/4/131452735/5a18fb010efa64.pdf
- https://cdn.shopify.com/s/files/1/0433/7106/9594/files/34529451882.pdf
- https://cdn.shopify.com/s/files/1/0429/0750/0711/files/mp_adivasi_song_2019.pdf
- https://cdn.shopify.com/s/files/1/0432/6499/9588/files/intro_to_psychology_kalat_10th_edition.pdf
- https://cdn.shopify.com/s/files/1/0434/4391/2856/files/xiruzigijugowefusedim.pdf
- https://cdn.shopify.com/s/files/1/0434/1003/0748/files/online_marketing_articles.pdf
- https://cdn.shopify.com/s/files/1/0429/3410/8323/files/regions_departements_et_arrondissements_du_cameroun.pdf
- https://cdn.shopify.com/s/files/1/0428/3462/4668/files/fimiludamopidu.pdf
- https://cdn.shopify.com/s/files/1/0432/6811/2550/files/tibopedis.pdf
- https://cdn.shopify.com/s/files/1/0432/7433/8454/files/divasoziwe.pdf
- https://cdn.shopify.com/s/files/1/0432/0378/8959/files/lucky_britney_spears_lyrics.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005b12.bin` `75b5f990e9c2ed3bef88acc347fab84cbab92d11797df5b335faaafc77f093cd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B12	4920 bytes
`font_01_sfnt_off00006bc8.bin` `49ad0ecbc47fc89bd014813c4b88815f086d6e12e317ad15be72a232bf8aef23`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6BC8	10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.