PDF malware analysis — malicious · 6d955359bd349afe

MALICIOUS

PDF

34.9 KB Created: 2020-08-31 05:12:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3d8763e11731f74206c8fdc3694c77c9 SHA-1: 89ca9199e3428720266d3cd6c10d38bfd000d964 SHA-256: 6d955359bd349afe054f6451e0f31069f42f0f41c39285c7769365b6ac41a709

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to external PDF files, suggesting a link farm or SEO spam tactic. One of the primary links directs to a known malicious redirector, indicating a malicious intent to lead the user to harmful content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=kingdom+hearts+final+mix+english+pat
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://cdn.shopify.com/s/files/1/0428/2449/9367/files/nofegimeruzo.pdf
- https://cdn.shopify.com/s/files/1/0429/4157/9420/files/wujexanigoso.pdf
- https://cdn.shopify.com/s/files/1/0434/5259/6374/files/6928416641.pdf
- https://static.usrfiles.com/ugd/c836c3_e71069be69a943cb805f5b44f9fdbc8e.pdf
- https://static.usrfiles.com/ugd/895bef_cf0f5ba0f6fd42b5b1f458808e4b9803.pdf
- https://static.usrfiles.com/ugd/b8c837_ec925e2f30cc4cc69696953a6fa378ec.pdf
- https://static.usrfiles.com/ugd/b8c837_e2c05fe871cd4a9784b5200d3a77d298.pdf
- https://static.usrfiles.com/ugd/e3ed1f_432729d24c9b48f298890985db7d04f9.pdf
- https://static.usrfiles.com/ugd/b8c837_f1c3366a4d0b44228f80c18f67190123.pdf
- https://static.usrfiles.com/ugd/e32576_0c1921448b8e470dab0cf91c0f6eca29.pdf
- https://static.usrfiles.com/ugd/760101_bea9f88aa42c4ca7b7cf3a1e9306dacd.pdf
- https://static.usrfiles.com/ugd/6203b9_426d5147afbd4a259e1285a6e378e629.pdf
- https://static.usrfiles.com/ugd/5438e3_b56fcd09958245ffbbf0bc20a0df6c32.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000481b.bin` `f98d1ff04737d6ab70e94c62e3846aa22a2c6525db01129588267495a0ca5fdb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x481B	5492 bytes
`font_01_sfnt_off00005a9f.bin` `33d509703bd5db7597c45710b8e0c35ae6d5ba89ec132d19bb631869db0e4ef1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5A9F	10740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.