PDF malware analysis — malicious · 6ba4e1dcb3cbec9a

MALICIOUS

PDF

48.6 KB Created: 2020-09-10 05:06:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e2095e43eaf449680f5c873ed0204493 SHA-1: 9655c5775463878b89cc7963ffb88920f9a1f37e SHA-256: 6ba4e1dcb3cbec9ac2e6e02c610c961aeacdebbf4b8e256efc2c224f886360c7

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link farm and a specific URL that is flagged as a malicious redirector. The document body, though heavily obfuscated, contains text related to a 'basic house rental agreement template' and the malicious URL. The presence of multiple links and the ML classifier's high confidence score indicate a malicious intent to redirect users to harmful content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/pify?keyword=basic+house+rental+agreement+template
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/a91264_8989a5b5dfe349f6a9757b48d34fa8ee.pdf
- https://static.usrfiles.com/ugd/451a43_3abf755c230a4f028a99891476453938.pdf
- https://static.usrfiles.com/ugd/ac51ce_5857026e1b7a4a1399d6539ceff8ad10.pdf
- https://static.usrfiles.com/ugd/b914b5_d87f811fa07c416ca19a82f48e0af6dc.pdf
- https://static.usrfiles.com/ugd/6c032c_4716933fda754e5f8b3fd0c569fd0fc4.pdf
- https://static.usrfiles.com/ugd/98e2de_13dd04006452499ba7c7d9bdbf98b66c.pdf
- https://static.usrfiles.com/ugd/9ff9b8_5d3e9c8c8a8f4c659b03d1f6768520a0.pdf
- https://cdn.shopify.com/s/files/1/0462/3214/1973/files/business_goal_setting_template.pdf
- https://cdn.shopify.com/s/files/1/0433/1733/0075/files/neginidabanetoj.pdf
- https://static.usrfiles.com/ugd/917232_07201daed64c443297508e086b398008.pdf
- https://static.usrfiles.com/ugd/b8c837_16a197206b3d42e798e881b61fe74dd9.pdf
- https://static.usrfiles.com/ugd/3cb6cb_73d2db52bf28484d8d9e7a179c056bd8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008129.bin` `6c16be27ba2def7c65bdc986f92a1a4f4d5633112b938faa56f39f6409db9e46`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8129	5396 bytes
`font_01_sfnt_off0000935a.bin` `79932f89a0c13d0111e278d548f27d2eb4dbe3c32875a4fb63b1dbd3a3ebadcb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x935A	10080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.