PDF malware analysis — malicious · 466b35bc40e1ce1c

MALICIOUS

PDF

54.1 KB Created: 2020-10-29 00:12:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31

MD5: e0bf55b92a9f069e6c267bbd8a0e104b SHA-1: 58ef7f57a992bc2d5882ad5723ace0bc042cb0b1 SHA-256: 466b35bc40e1ce1c64b1d75b02e755a2c1f5b1a355001f1a1f5313e175001493

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://gettraff.ru/strik?keyword=apache+karaf+cookbook+pdf+download', which is flagged as malicious. This suggests the document is designed to trick users into downloading further malicious content or visiting malicious sites, likely as part of a phishing campaign.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=apache+karaf+cookbook+pdf+download In PDF document text
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/pagixapefaxa_dagalu.pdfIn PDF document text
- https://vefavufarexuba.weebly.com/uploads/1/3/4/3/134315694/595446.pdfIn PDF document text
- https://tegugozitofo.weebly.com/uploads/1/3/0/8/130874592/9856162.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0268/8571/8197/files/25133111197.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/5417/7185/files/plyometric_box_exercises.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0486/0575/7605/files/41735560177.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/9148/3032/files/i_hope_so_kodak_video_download.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/5106/4228/files/51841210061.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75c197f4-418a-4269-89b6-8d454a7cd193/3227058605.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/8361/9232/files/sipuf.pdfIn PDF document text
- https://s3.amazonaws.com/vuraradaso/82571209622.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7852cf9-390a-4a15-b978-92d58928be0a/3320410058.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/598736d0-4345-4955-bed9-2759a154f567/gemifel.pdfIn PDF document text
- https://s3.amazonaws.com/dixaleko/mofugilufavodom.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/9721/8471/files/articles_of_confederation_dbq.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/0056/8221/files/addition_problem_solving_worksheets_for_grade_2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b180576d-b104-4d3d-ace7-df6d27710ccd/7695328993.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5beeaa0-ca04-431b-973e-79b5fb882012/19407414745.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/006360a6-b8b1-469a-a85a-9e91af78a7b9/rabivigutuladibajo.pdfIn PDF document text
- https://s3.amazonaws.com/suzixegazunow/functions_of_central_bank_and_commercial_bank.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6bb2a9a-803f-4684-b7b2-d5e5a43f59a8/zulexonako.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/8352/9885/files/planet_hulk_full_movie_download_in_telugu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000077e1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77E1	5348 bytes
SHA-256: `48eeead7c8fdf2bae783b4343d23ded8cbef325ff8c9fe7f95a2ff122c74a4bc`
`font_01_sfnt_off00008a17.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A17	11500 bytes
SHA-256: `cbf5bbb98e3564f4bf93bc51ba9a831c0c028a2307d3b436b4ed7ebf42a96f3e`
`font_02_sfnt_off0000b081.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB081	17684 bytes
SHA-256: `d62ed4ade48c7d220c39f5ba129f5abbc82563dc4cd586f90592ac6aacae490d`

Open this report in the interactive analyzer, or submit your own file for analysis.