PDF malware analysis — malicious · 5f516c1b4a931c05

MALICIOUS

PDF

39.8 KB Created: 2020-08-30 05:08:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 629d3ae6f33c2d4a8fc57ab30b794240 SHA-1: 2f4c9bdc37b172ee2da843bd30cd4162d30c70be SHA-256: 5f516c1b4a931c05ef4a4709fda77139d4f202567f0c4925e3cd3e942e3135a5

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs, with one identified as a malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure related to a game and includes the malicious URL. The presence of numerous external PDF links, many pointing to benign content, suggests a link farm or SEO poisoning attempt to mask the malicious redirector.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=the+world%2527+s+easyest+game+cat
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/238140_1e9cef049ae64ffd987f90fb094c111b.pdf
- https://static.usrfiles.com/ugd/4cf28d_d6c94a0615204007b6d5630966e288b5.pdf
- https://static.usrfiles.com/ugd/b8c837_6b43c36551df486a99cca52e01e9887d.pdf
- https://static.usrfiles.com/ugd/b8c837_8d49e5c5caf9482085299ed73482cb7e.pdf
- https://static.usrfiles.com/ugd/e2c250_b4916b0a92854218a459ece5efca33c3.pdf
- https://cdn.shopify.com/s/files/1/0428/7673/1558/files/bestiariusz_starego_wiata_chomikuj.pdf
- https://cdn.shopify.com/s/files/1/0428/2603/9463/files/2625127884.pdf
- https://cdn.shopify.com/s/files/1/0429/9010/8833/files/puketopinaduwipoxizet.pdf
- https://cdn.shopify.com/s/files/1/0432/6142/7876/files/tokezubirop.pdf
- https://static.usrfiles.com/ugd/b8c837_5dbf96486d1345f7ba4eb35ac3ca0a94.pdf
- https://static.usrfiles.com/ugd/b8c837_3842ec0a0f7e494db8f98f513ddb4dfc.pdf
- https://static.usrfiles.com/ugd/b8c837_64705baa84e54f04aaef17b344e24764.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d43.bin` `d693b98f3d72099d1df271b9538315420475ab97c0d1bb19ef6b2198c671fa08`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D43	5532 bytes
`font_01_sfnt_off0000700e.bin` `0b530e919ce43009852f2815c88029d3ae73edde3f7055781b6fe42ede76abf2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x700E	10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.