PDF malware analysis — malicious · 633aeea6549d60d4

MALICIOUS

PDF

49.4 KB Created: 2020-10-27 01:43:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22

MD5: 1deb63c9201bd944688d41c49b4a7ffe SHA-1: 9159000e5c79c93cecb0719eb1b0d402a35481ba SHA-256: 633aeea6549d60d4b721457b1cac5d1717e8d76baeba5474fcbed3a97d332ad2

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded links, with at least one identified as a malicious redirector. The document body, though heavily obfuscated, includes the URL https://cctraff.ru/strik?keyword=safari+zone+map+red+version, which is flagged as malicious. This suggests an attempt to lure the user to a malicious site, likely for further exploitation or phishing.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=safari+zone+map+red+version In PDF document text
- https://jasazifo.weebly.com/uploads/1/3/1/4/131437377/4263667.pdfIn PDF document text
- https://lokixesope.weebly.com/uploads/1/3/1/6/131607163/7773321.pdfIn PDF document text
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/temuremim-jitit.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/a8cbffd1-efb9-445c-ab97-001aa73c220a/84606473286.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d751dd62-2f8e-45fb-9907-8beb0cd8156b/fanopivumepimuxa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d20bbbd-5c6d-45e3-9798-f69adfac7d8d/champion_spark_plugs_catalog.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/292307b6-1df8-41a9-87a2-fde0a7ce260f/21451116023.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dca89cb7-aee3-4900-b144-793164f350e0/30431613870.pdfIn PDF document text
- https://s3.amazonaws.com/bevarolimesale/cidco_lottery_2019_navi_mumbai.pdfIn PDF document text
- https://s3.amazonaws.com/wukara/mebubefegomaniboxobajot.pdfIn PDF document text
- https://s3.amazonaws.com/wuniku/argumentative_writing_quiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/82d23ebe-72f2-423e-924a-5b8ae67dcfb6/31454362141.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/465018fd-231c-4076-994b-ed4e7bb7c16d/1147956834.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3616665-0711-4640-a72d-d5503fb85b8b/pafotagaxa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72590fbb-0aa0-423b-ab57-13a2bf55872f/47462735708.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ad334cc-3e40-472c-b5b1-7a4291fc844e/the_godfather_2_online_subtitrat.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/0397/7634/files/jikevaxoketokugofa.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0432/7112/7208/files/bubble_tea_kit_nyc.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/3441/8586/files/fediwogosedevifulitoz.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/6093/1991/files/33333774505.pdfIn PDF document text
- https://s3.amazonaws.com/muvojugejoxip/topographic_surveying_and_mapping.pdfIn PDF document text
- https://s3.amazonaws.com/fazujo/gitiwinakun.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000066df.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66DF	3348 bytes
SHA-256: `4f9b80bbd549e83da31015b00a715e7f8d0f638d7d18ff69f6fe27a3a7e1b051`
`font_01_sfnt_off000072e6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x72E6	5076 bytes
SHA-256: `996a01aeb01db7671525d054d8055d71257f0a730572df140959880ee52df30c`
`font_02_sfnt_off00008409.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8409	10592 bytes
SHA-256: `e07e720274e3573bfe43f2ef8ea7ffc5e25184d9230bbb0333814472f3a2106a`
`font_03_sfnt_off0000a81d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA81D	4324 bytes
SHA-256: `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`

Open this report in the interactive analyzer, or submit your own file for analysis.