PDF malware analysis — malicious · 6d9bef3ab97151dd

MALICIOUS

PDF

45.5 KB Created: 2020-08-29 16:04:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8487b7fbe607ce1e05b0f02dae443afc SHA-1: b6b429314656fb348c60c2f45705527d409bd8ac SHA-256: 6d9bef3ab97151ddb5280929229a4ac03f32d813056b259c7d5cbce0338be37d

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to a link farm designed to redirect users to malicious content. The primary redirector URL, https://ttraff.com/wix?keyword=no+mira+ninguna+oferta+para+los+cora, is flagged as malicious. The document body itself is heavily obfuscated and contains the same redirector URL and a list of other PDF links.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=no+mira+ninguna+oferta+para+los+cora
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/b8c837_1bb2aa7339834f3a8358bd9568f5b3e9.pdf
- https://static.usrfiles.com/ugd/b8c837_9f693ccbc5d6437c9ed79c805889af93.pdf
- https://static.usrfiles.com/ugd/b8c837_c97d650ad7d44f28b86e8513a051f3d3.pdf
- https://static.usrfiles.com/ugd/455f95_6bc153fb1d2340d3ba5cf636c45f9f0c.pdf
- https://cdn.shopify.com/s/files/1/0431/9150/0961/files/bahubali_2_all_songs_pagalworld.pdf
- https://cdn.shopify.com/s/files/1/0432/6116/5723/files/wuvorelijaraxovutemajat.pdf
- https://static.usrfiles.com/ugd/b8c837_cc5c1ca9c9a94096a5d4d6580337202a.pdf
- https://static.usrfiles.com/ugd/b8c837_479b3f72c64e40299062c282b159bf7e.pdf
- https://static.usrfiles.com/ugd/b8c837_dce3492ddc904da6843f81230637b7e9.pdf
- https://static.usrfiles.com/ugd/b8c837_d77506e3517540b19d940f67c4ba78e6.pdf
- https://static.usrfiles.com/ugd/b8c837_f9a76637d0b0456eb2d7cc0d08568385.pdf
- https://static.usrfiles.com/ugd/b8c837_411da9f96bd64d42b5d9faf7ff2e1b4c.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000070a8.bin` `093840621b162807a00deaede98a69136ac925c023c4502c7c10d44bbeb3077e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x70A8	5304 bytes
`font_01_sfnt_off0000829e.bin` `241f05c0eb96dabfe7990c1f16fbdea857e0822567c1291f2512b9c7c23bac85`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x829E	11472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.