PDF malware analysis — malicious · 668f3aace7dc1b8e

MALICIOUS

PDF

50.1 KB Created: 2020-08-30 08:11:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5fb80c8701457d1b8b6c84d41a93e6d5 SHA-1: de953090cd079b897dc63f951200b51764fecbde SHA-256: 668f3aace7dc1b8e15acff3bbe12a1aab9419db60ade3206b1ea09e2543d0440

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF was flagged as malicious by a machine learning classifier and contains a high number of embedded links, many pointing to external PDFs. One of the primary links, 'https://ttraff.ru/wix?keyword=graham+hancock+tedx+dmt', is identified as a malicious redirector. This suggests the document is part of a link farm or SEO manipulation scheme, potentially leading users to malicious sites or hosting further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=graham+hancock+tedx+dmt
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0428/8430/0959/files/lopiz.pdf
- https://cdn.shopify.com/s/files/1/0433/6048/5541/files/mathematics_for_economists_norton_1994.pdf
- https://cdn.shopify.com/s/files/1/0437/9613/6097/files/57711819752.pdf
- https://cdn.shopify.com/s/files/1/0427/9291/1007/files/mr_boombastic_mr_fantastic.pdf
- https://cdn.shopify.com/s/files/1/0429/5095/1066/files/12627983692.pdf
- https://cdn.shopify.com/s/files/1/0430/6544/2455/files/29576215780.pdf
- https://cdn.shopify.com/s/files/1/0428/7823/8886/files/63918619799.pdf
- https://cdn.shopify.com/s/files/1/0434/3303/3880/files/bebexurobolelorazij.pdf
- https://cdn.shopify.com/s/files/1/0429/8326/0314/files/24341240417.pdf
- https://cdn.shopify.com/s/files/1/0434/0475/5096/files/turosexok.pdf
- https://static.usrfiles.com/ugd/784815_1a5fec35c13a45a09a9844bfa4f48d31.pdf
- https://static.usrfiles.com/ugd/b88e3d_c2caad437c03481dbc8c672438d41d18.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008718.bin` `a1af8d087bb467cbf7d23c0afaa41adea751d7332ea6251c265fa0c67efd557b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8718	5132 bytes
`font_01_sfnt_off00009867.bin` `98d606be999c8f32d32991dcde36c687e018f1addc68825fc9c5c8444661b673`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9867	10376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.