PDF malware analysis — malicious · 5a69d1c6e8ff8016

MALICIOUS

PDF

43.4 KB Created: 2020-09-09 13:03:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 64a0e336432a5cd194c219b1a75c2631 SHA-1: a09c2406c01d936313e6fff260776387403fa08b SHA-256: 5a69d1c6e8ff8016403642123a4c67042ba8eccc71f8b7974df01d9541b99c9b

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm and a direct link to a known malicious redirector, disguised as a job advertisement. The ML classifier strongly indicates maliciousness. The embedded link `https://ttraff.club/wix?keyword=bihar+police+constable+bharti+2019+pdf` is the primary indicator of malicious intent, likely leading to a phishing or malware download site.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=bihar+police+constable+bharti+2019+pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/f3bfbb_1fa82f89b55b4ff6a37ee1280923e6a4.pdf
- https://static.usrfiles.com/ugd/296484_721c39874d404de3b297f9963167d06f.pdf
- https://static.usrfiles.com/ugd/724fb5_85248623f2034bbab094e8843f3d03ab.pdf
- https://cdn.shopify.com/s/files/1/0431/4673/9868/files/pufepanabiwelo.pdf
- https://cdn.shopify.com/s/files/1/0432/2512/0927/files/bajaj_allianz_health_insurance_plans.pdf
- https://static.usrfiles.com/ugd/fe0276_a113692bc5ea4e5bbc25409402df357a.pdf
- https://static.usrfiles.com/ugd/e1d58f_4e4350d48d214700abedb9c5a93338ca.pdf
- https://static.usrfiles.com/ugd/bd1c09_e4fe0da5df6140188008cdf3c4917e16.pdf
- https://static.usrfiles.com/ugd/b3bc21_588471e3adec458a9068ffd7263c7d17.pdf
- https://static.usrfiles.com/ugd/1e52da_08265a4e1ff24955a7dff245f1448d80.pdf
- https://cdn.shopify.com/s/files/1/0431/8255/5297/files/zejojudo.pdf
- https://cdn.shopify.com/s/files/1/0434/4171/7415/files/61206122553.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006b5c.bin` `3b0241df8ef9a13fc14a0b655c72405a344af023f3537f81e0dadf805f3a95ba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B5C	5916 bytes
`font_01_sfnt_off00007f6f.bin` `584da423cd6f6868f57fc50b1d8b95b984c92353c251c6c74927c75d920bcdde`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F6F	9796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.