PDF malware analysis — malicious · 785785e3c8a0aa32

MALICIOUS

PDF

38.9 KB Created: 2020-08-31 00:48:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 23b4dea38477429c81dcb06098237381 SHA-1: e498e200e74c687caa3d9ff415f6385bba7eabc3 SHA-256: 785785e3c8a0aa325e9ad4ddf3cf23a379d4b87aa0985b09c687e124826bdebb

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that lead to a redirector URL, which is flagged as malicious. The document body, though heavily obfuscated, contains text that appears to be a lure for an audiobook download, suggesting a social engineering tactic. The presence of multiple links to external PDFs indicates a link farm, likely used to distribute malicious content or for SEO manipulation.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=fallout+equestria+project+horizons+audiobook+download
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/4479ed_b75a7cf57b804302b8cf5af0eb16ea14.pdf
- https://static.usrfiles.com/ugd/41a0b6_7d0a8a13cdf84657b1d99eaf4907f99f.pdf
- https://static.usrfiles.com/ugd/9ea91e_e8602217de4d4e4ea4169278b33c139e.pdf
- https://static.usrfiles.com/ugd/57c819_e82eca37ae8d4374b72557bb770fc853.pdf
- https://static.usrfiles.com/ugd/e2c250_c7fe3361c9024fdd9cb5194b4e83ccb3.pdf
- https://static.usrfiles.com/ugd/0d2908_624ef111da534677a2aa16473f0ed8d8.pdf
- https://static.usrfiles.com/ugd/a64c8c_50bcbd8fa7f6490a91e79960eba04963.pdf
- https://static.usrfiles.com/ugd/c0b427_add7bbf60a7749cf8bb26650138fca9e.pdf
- https://static.usrfiles.com/ugd/79e0dc_f95668d84fe14a3a9990bdf9882f0913.pdf
- https://static.usrfiles.com/ugd/b9801a_3f2b7051cde5469ab051ccd9deb4c579.pdf
- https://static.usrfiles.com/ugd/b8c837_608f256606fc4cddb6c01466de91364c.pdf
- https://static.usrfiles.com/ugd/384ea4_8eff827d9e914110a8a899889bbb0f36.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000057ce.bin` `1ebb973cdf9fee2a3457ba2b536f4b4b757749ce394299e6b24f8c41efa1b68c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x57CE	5664 bytes
`font_01_sfnt_off00006b1c.bin` `d69698bf4095ded27dc93f53c15e7732a076fe94f1e54d19a9115daf36a60ed4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B1C	10356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.