PDF malware analysis — malicious · 455b985c6cbcedd3

MALICIOUS

PDF

45.3 KB Created: 2020-09-20 04:53:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d076e87352016904270c202566b5ef57 SHA-1: f5b569c51419d6fb5ea20f9c4b54b26c6809edc3 SHA-256: 455b985c6cbcedd3241932760d218167601f8f986b29b9c429b63b67d3d4c3c0

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with the primary malicious URL being https://ttraff.club/wix?keyword=ds203+oscilloscope+manual. This URL is flagged as a known malicious redirector, indicating the document is likely part of a phishing or malware distribution campaign. The document body, though heavily obfuscated, contains references to the lure URL and other benign-looking PDF links, suggesting an attempt to disguise malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=ds203+oscilloscope+manual
- http://files.morganleephotography.org/uploads/1/3/2/3/132303270/4129911.pdf
- https://cdn.shopify.com/s/files/1/0430/3772/0733/files/nifaj.pdf
- https://cdn.shopify.com/s/files/1/0433/0491/1006/files/novefifijuxinitetiwilo.pdf
- https://cdn.shopify.com/s/files/1/0441/4350/9656/files/wovotaxivolabapi.pdf
- https://44715d93-9030-4137-b8ba-670e8bc5cd3a.filesusr.com/ugd/4dd980_cdb8bff54376478d88f7f8c0afa11b73.pdf?index=true
- https://2593bd12-f77a-48aa-94ae-b56a1b56366c.filesusr.com/ugd/d93890_4f292d4d78c74d38bfdfe886a6b9c649.pdf?index=true
- https://31adc7ab-9a62-44ac-85c5-c7df0d23a78e.filesusr.com/ugd/1479de_ca77c528e1624eef91c21436a4735a2f.pdf?index=true
- https://d8ab3210-237c-4a97-a6ac-18c5e41c5d4d.filesusr.com/ugd/9c58c5_1cc03ab712be464f837e3ac50447c500.pdf?index=true
- https://cdn.shopify.com/s/files/1/0465/9429/3925/files/soxemojawigefasokotutiga.pdf
- https://cdn.shopify.com/s/files/1/0440/1584/5541/files/roman_candide_en_arabe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000736d.bin` `093dad4a6e592b04a7dad4b1df87781a679cefed905df54254669835d8a9078e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x736D	5420 bytes
`font_01_sfnt_off000085d0.bin` `06d02a1c07f71b53b210ac9e327972952189624933e36dd09786802c5c301163`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85D0	10296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.