PDF malware analysis — malicious · 7c8e4901ae97cdb3

MALICIOUS

PDF

93.3 KB Created: 2020-11-05 16:09:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7f9f6cc0600bd697a60e726f7f28305c SHA-1: 77b47a39f50c3aca8e1fe9e60f755e015fd5645b SHA-256: 7c8e4901ae97cdb300cb803ae22048e37ec25e2059ff5428d75e0cc3dd02132f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a link farm, pointing to multiple external URLs, one of which is `https://trafffe.ru/aws?keyword=tank+trouble+hacked+arcadeprehacks`. The document body, though heavily obfuscated, contains references to game-related keywords and the suspicious URL. The presence of numerous external links suggests an attempt to drive traffic or distribute further content, aligning with a spearphishing attachment tactic.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/aws?keyword=tank+trouble+hacked+arcadeprehacks
- https://cdn-cms.f-static.net/uploads/4370269/normal_5f9d62e017dca.pdf
- https://cdn-cms.f-static.net/uploads/4426830/normal_5f997d7df3f5e.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f86f4939a177.pdf
- https://cdn-cms.f-static.net/uploads/4369166/normal_5f88624be8b8a.pdf
- https://cdn-cms.f-static.net/uploads/4366327/normal_5f8b34ea4e6ea.pdf
- https://bujibapi.weebly.com/uploads/1/3/4/3/134383234/redonamerodat.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/wonoti/characterization_worksheet_2_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0266/8039/3900/files/39616191021.pdf
- https://s3.amazonaws.com/lekizopiloref/our_lady_of_divine_providence_milwaukee.pdf
- https://s3.amazonaws.com/poresi/82400873215.pdf
- https://s3.amazonaws.com/lewuli/tyrone_s_games_minecraft.pdf
- https://s3.amazonaws.com/tudawufed/87521446524.pdf
- https://s3.amazonaws.com/gebukil/12550532270.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001122c.bin` `6f3423302530c950b0a359eca81f6c5aafb794cfd4540584b230f3bff8df28bb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1122C	5316 bytes
`font_01_sfnt_off0001242d.bin` `ac6ff3d7a0e5c21bc18bb4e1420d25c45effe89aa78cb40681cc1859f44e8f12`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1242D	14776 bytes
`font_02_sfnt_off0001525e.bin` `2a5f1667c2e343500efde63e3dd6a136498333968b1680966ac5eb34589f1174`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1525E	16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.