PDF malware analysis — malicious · 47b617d119837f13

MALICIOUS

PDF

42.5 KB Created: 2020-08-30 15:51:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 16f350d583ddae0ffe92fa140d9b4e02 SHA-1: 500de5fd7aed57c3a925581b14cdfc8ce469c374 SHA-256: 47b617d119837f1374f5b3550706a3f1f62a6ed4460035d161c24e7e9f9b542c

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious and contains a significant number of embedded links. One of these links, 'https://ttraff.ru/wix?keyword=methods+of+conducting+environmental+impact+assessment', points to known malicious redirector infrastructure. The presence of a link farm suggests an attempt to lure users to malicious sites, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=methods+of+conducting+environmental+impact+assessment
- https://static.usrfiles.com/ugd/7603ae_e7598c1f83c54ade9f92635ad9e40543.pdf
- https://static.usrfiles.com/ugd/b8c837_4a9d8c3bd2f34959b9573af6e6a70b68.pdf
- https://static.usrfiles.com/ugd/b4609a_de2ca1d3bf6d4edcb9f0d568fb4c5c79.pdf
- https://static.usrfiles.com/ugd/b8c837_0e25616a42784c19918a1d75b5424f0e.pdf
- https://static.usrfiles.com/ugd/ae15ca_9ef80702adb74c489c977836fe245e10.pdf
- https://static.usrfiles.com/ugd/eed56f_ed6ab39076954ecfabc7beb566f49b43.pdf
- https://static.usrfiles.com/ugd/d7ba0f_db31451e0db648b4b3673dec1ef7f33b.pdf
- https://static.usrfiles.com/ugd/b8c837_e023013883454fd4b69c07d462d57702.pdf
- https://static.usrfiles.com/ugd/b6edda_e2c58dcf4cc04d6f9f5f5c9eae154f08.pdf
- https://static.usrfiles.com/ugd/10e3af_2e4b731eb1424c5fa80010deac8f12a7.pdf
- https://cdn.shopify.com/s/files/1/0431/5247/4267/files/65104677979.pdf
- https://cdn.shopify.com/s/files/1/0429/4334/8892/files/xowekizewaxinabawikob.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006732.bin` `d35dfe6be618917efc7738cf3ebed19d8b89e2ca62c0aca3935cf485cafc4d32`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6732	5636 bytes
`font_01_sfnt_off00007a3f.bin` `4224b9a3b904aa4204d91b0f2cc5cc80515ae6355eced2b6009b1458c00c6af6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7A3F	10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.