PDF malware analysis — malicious · 7791e8538fa25d7e

MALICIOUS

PDF

40.8 KB Created: 2020-09-02 02:52:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1f221d702a1ca4742a73b48d7424af0b SHA-1: 68cf6f5f7806408d5533989948a81ffc11b77c3f SHA-256: 7791e8538fa25d7e3b986cc7f304ba0d1c82acedd3c6917eb903df5644e0f914

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying it as a redirector to malicious infrastructure. The primary malicious URL identified is https://ttraff.com/wix?keyword=user+manual+airdots+pro, which is likely used to redirect users to a phishing or malware download site. The document body, though heavily obfuscated, contains references to user manuals and the malicious URL, suggesting a lure to trick users into clicking the malicious links.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=user+manual+airdots+pro
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/c75f60_89c8e4f4d345440ea0b6e6c41641cd6e.pdf
- https://static.usrfiles.com/ugd/c20ea7_cc1e9b6bb4524741bd48db0cbdcc044d.pdf
- https://static.usrfiles.com/ugd/b8c837_4f8343cff1d749209f13e85b872057f1.pdf
- https://cdn.shopify.com/s/files/1/0433/9043/5495/files/bofuwuxawaliperegemem.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/zikoraj.pdf
- https://static.usrfiles.com/ugd/d2751c_c7095180891d47aca2a7cd21cbd7d3cc.pdf
- https://static.usrfiles.com/ugd/a891c0_9284d494d01b4fddba76b66279df1bb9.pdf
- https://cdn.shopify.com/s/files/1/0430/1111/3123/files/kenmore_water_softner_manual.pdf
- https://cdn.shopify.com/s/files/1/0440/0952/1317/files/75492225080.pdf
- https://cdn.shopify.com/s/files/1/0434/7238/8249/files/59999798535.pdf
- https://cdn.shopify.com/s/files/1/0435/5024/5028/files/selavofivetev.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005e52.bin` `4c10ec5a41c7e6922d826f36b9dd9933b7974e57dd3733f813bce08d741c83cf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E52	5096 bytes
`font_01_sfnt_off00006f8c.bin` `3d980306b6f952417e58dbb01f2cc8824458dcab68ec1825e141d5a040d255d6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F8C	11904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.