PDF malware analysis — malicious · 62ed5ef6352a8372

MALICIOUS

PDF

47.6 KB Created: 2020-10-28 00:56:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 90711bbb802526693f3b2cd6a44429ee SHA-1: 2b1980bd40eb99863185020a87a4b2d444906df1 SHA-256: 62ed5ef6352a837288c00297c9ab5d5e956791fc111cdc1d034c4e5a0252838e

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to disposable hosting services and a known malicious redirector. The primary malicious URL identified is https://ggtraff.ru/123?keyword=american+directions+group+complaints, which is flagged as a malicious redirector. The document's structure and content suggest it is part of a link farm designed to drive traffic to potentially malicious sites, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=american+directions+group+complaints In PDF document text
- https://doxeduzawixufak.weebly.com/uploads/1/3/4/3/134383044/lejek-wuverowefopaj-gebanudo.pdfIn PDF document text
- https://babinekisifuve.weebly.com/uploads/1/3/2/6/132696104/98a531d6b1c.pdfIn PDF document text
- https://jufavufopu.weebly.com/uploads/1/3/4/3/134340263/mezomifakedit_gapemimigezafup_luvor_fiseximipewudug.pdfIn PDF document text
- https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/7140836.pdfIn PDF document text
- https://fegibaja.weebly.com/uploads/1/3/4/3/134305779/zuworufukazavul-rigop-mupinaxivif.pdfIn PDF document text
- https://gelekale.weebly.com/uploads/1/3/4/2/134266195/bb5a80fb.pdfIn PDF document text
- https://moguvikob.weebly.com/uploads/1/3/0/8/130874292/7343167.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370560/normal_5f930c208b2b5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375195/normal_5f8a1f1286ad1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383165/normal_5f90ce9f23eb4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382782/normal_5f94802e4db02.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369174/normal_5f8d41f44ec8a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387232/normal_5f9125f92c8c7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379726/normal_5f8e762137a47.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417037/normal_5f95e3215d08c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0432/8888/7460/files/bisezajisaxirefonezod.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0502/1673/0799/files/automating_inequality_virginia_eubanks.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/5349/3655/files/41855916113.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0502/8446/2274/files/qr_code_app_android_studio.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006a9d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A9D	5264 bytes
SHA-256: `c6292b5a388753d2ba5c633decbdba54b961fa7ddfc919cf6598f877c4c164eb`
`font_01_sfnt_off00007c58.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C58	11288 bytes
SHA-256: `30ff43c9a766d1adc17231ecc0f9bdb156f90a156762bd970f9ea94650f8e0c6`
`font_02_sfnt_off0000a2c1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA2C1	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.