PDF malware analysis — malicious · 67269d9daee90007

MALICIOUS

PDF

35.0 KB Created: 2020-09-05 16:46:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 75d59b9db85edd0b7d25c5753d62fa6c SHA-1: 5753ae28a7fd0eabf3569ef55226cb6c8898935f SHA-256: 67269d9daee90007c58b4691e2fb1627404c0d2b5014c43fb089c6fc60dbffc8

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious due to a high number of embedded links, many of which point to redirector infrastructure. The document body contains a URL that appears to be part of a link farm, likely intended to lure users to malicious sites or distribute further payloads. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9987

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=mahadev+maharaj+banjara+bhajan In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/8201/5135/files/biopsychosocial_examples.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0453/8466/3208/files/crs_uk_reporting_dormant_account.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/5840/5275/files/vitoreworokipuloxela.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/0234/6148/files/64680486595.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0441/1083/9960/files/54978728669.pdfIn PDF document text
- https://static.usrfiles.com/ugd/800b88_c789b6709bac4357bff28cbc77b842fa.pdfIn PDF document text
- https://static.usrfiles.com/ugd/c75f60_8f6b7b404c6845e8a4659abc0076bd0e.pdfIn PDF document text
- https://static.usrfiles.com/ugd/ca9b0a_37b11f3f99bc437baaecd980b6f56ed6.pdfIn PDF document text
- https://static.usrfiles.com/ugd/e643da_33e31c848463474c866f0718e868db3f.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_c6150c041ccb4345925c5fd6b6871249.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_92d19a79efe345d0bc8ffa3f4fb0913e.pdfIn PDF document text
- https://static.usrfiles.com/ugd/9e53d4_cd9a5f28640b4343ab0cb660bb799dae.pdfIn PDF document text
- https://static.usrfiles.com/ugd/b8c837_704e379a2a26416eabe240f17ddfaf37.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/5785/4102/files/aprendizaje_cooperativo_autores.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/5347/3189/files/anaconda_4_tamil.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004e66.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4E66	5136 bytes
SHA-256: `f03624cf8532500d426211a032fd9d079c92a10e77e4fd61f88d8760290ab26e`
`font_01_sfnt_off00005fc0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FC0	13040 bytes
SHA-256: `801fc63e507674e571717dc171d30793a27967a0800203ba94f4c8eb003434d6`

Open this report in the interactive analyzer, or submit your own file for analysis.