PDF malware analysis — malicious · 6934a2dae815f63b

MALICIOUS

PDF

40.7 KB Created: 2020-10-31 00:54:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 044408dc2edd25ec9796e7c2ff4d088f SHA-1: bf461d43edd92e95fef82b7375e0f7706ccb6871 SHA-256: 6934a2dae815f63b8a88953201a2f10510446719e3f7beda367c0c170274d831

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to external PDF files, suggesting a link farm or SEO poisoning attempt. One of the primary links, https://ttraff.cc/123?keyword=guess+the+gif+person+answer+movie+bow+and+arrow, is identified as a malicious redirector. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=guess+the+gif+person+answer+movie+bow+and+arrow
- https://lirutuve.weebly.com/uploads/1/3/4/4/134462413/jolonuvesodus-rafelajiz.pdf
- https://kofejadadamutu.weebly.com/uploads/1/3/4/3/134348877/1767028.pdf
- https://zegexexu.weebly.com/uploads/1/3/4/3/134385137/7783477.pdf
- https://fukobararusi.weebly.com/uploads/1/3/4/4/134404541/wijupe.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f87bdaf78d5a.pdf
- https://cdn-cms.f-static.net/uploads/4368951/normal_5f8b690020a7b.pdf
- https://temazojirilezin.weebly.com/uploads/1/3/2/3/132302863/13cf37ad5874.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/8af46d41-0910-4e8f-ba9b-020d516a31cc/grammaire_anglais_franais_vocabulaire.pdf
- https://s3.amazonaws.com/sibenuvokiwuz/sajokijariwima.pdf
- https://s3.amazonaws.com/baxunaf/jutofefuja.pdf
- https://cdn.shopify.com/s/files/1/0432/6601/5395/files/discord_push_to_talk_toggle.pdf
- https://cdn.shopify.com/s/files/1/0430/1966/5561/files/pafalilobisijodawivila.pdf
- https://cdn.shopify.com/s/files/1/0500/6298/3363/files/87785208060.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005f9c.bin` `a01e650f39b899dfa3e3d8e64695d9001033e7ce89d8bf5d5427585ad994cae1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F9C	5748 bytes
`font_01_sfnt_off00007315.bin` `9e8fa0df535a97188b958627c44e5eff32e62d1f5586ef703961ca19289250bb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7315	10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.