PDF malware analysis — malicious · 5dd9facdffcc03e3

MALICIOUS

PDF

44.2 KB Created: 2020-08-30 15:05:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 51e5b52b51ec19ff5b8ce2c140147110 SHA-1: 218d9debd46067d92ccaab4ddbf6d985608135fd SHA-256: 5dd9facdffcc03e34d319dbe30028a11d4de3d5e7d77e20d7dc953bf4eb5dcb3

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to a redirector infrastructure. The document body, though heavily obfuscated, contains text related to "Ejemplos de balanceo de ecuaciones q" and the malicious URL, suggesting a lure to a link farm or SEO spam campaign. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=ejemplos+de+balanceo+de+ecuaciones+q
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/b8c837_4b8b50b6c65d44b3a894d9dbbbea10e3.pdf
- https://static.usrfiles.com/ugd/b8c837_9d6ac805ccef4705aeed88c6bf67e36f.pdf
- https://static.usrfiles.com/ugd/b8c837_60dc015ac09b45b9bad1647d7fa67711.pdf
- https://static.usrfiles.com/ugd/dc98cc_ac67b3af6dfc4a56a0b8f3b5c6b8df5e.pdf
- https://static.usrfiles.com/ugd/b8c837_f6838e4ac79d4bb3b46e4367ecfe7b12.pdf
- https://static.usrfiles.com/ugd/b8c837_6ca6542135bd4338936826dc674c0e5c.pdf
- https://static.usrfiles.com/ugd/3b47cb_7e7d24f623ea485f80c395a6f634f7a3.pdf
- https://static.usrfiles.com/ugd/b8c837_c89056227e6f45a3a5d8eed9a9e47951.pdf
- https://static.usrfiles.com/ugd/04e6f9_be79d7a8a079424c89254b584bd09a9e.pdf
- https://static.usrfiles.com/ugd/b8c837_2fb875fa3d1c47099af43c8358cca095.pdf
- https://static.usrfiles.com/ugd/b8c837_4180453556b74d8f9be19202241c0252.pdf
- https://static.usrfiles.com/ugd/b8c837_3ab7b9b7cac4400d8e37a715ce753a03.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ceb.bin` `909a755e4bcd6560fd0ac43c2f16602b0aa14f79efaaeab96ee50d3e48a79ec8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6CEB	5424 bytes
`font_01_sfnt_off00007f47.bin` `2ee5d08bfc120ba3d5e8066ecc7fac739db36495a64518fb0a04cd8c40256f61`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F47	10908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.