PDF malware analysis — malicious · 7e2aae64f3a2c43a

MALICIOUS

PDF

35.5 KB Created: 2020-09-12 22:45:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ea32af77a59edbfd77656db600392211 SHA-1: ebcbb0eb958451f029853d957bc28dc5a99bb51e SHA-256: 7e2aae64f3a2c43a3b950f8dea830eef9ac5e3063d88aab0be7859472eac98e2

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a critical heuristic firing for a malicious redirector link, which is also present in the document body. This link, 'https://ttraff.link/wix?keyword=smartcric+apk+download+apkpure', is designed to lure users into downloading potentially malicious content by impersonating a legitimate download. The PDF also contains a large number of external links, many pointing to static.usrfiles.com, which is flagged as a link farm. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=smartcric+apk+download+apkpure
- https://static.usrfiles.com/ugd/704f6c_c5ad93ecbc9f443a9af52fdaf0b44bb2.pdf
- https://static.usrfiles.com/ugd/efb3f0_3e46209843344546a40973997e7b0d75.pdf
- https://static.usrfiles.com/ugd/374ce0_f28042e1c4f94969a4de70e78a1bcb6b.pdf
- https://static.usrfiles.com/ugd/79cb75_e042dac16ae24e609247d6918d4e8180.pdf
- https://static.usrfiles.com/ugd/e4d7df_c6226c4ba04a4969a255c8846fa53ec4.pdf
- https://static.usrfiles.com/ugd/8da65f_92219601f8ae49ff82a785f7833a1e77.pdf
- https://static.usrfiles.com/ugd/19103d_a0b39d52cb4b4291a1746ad838abe44c.pdf
- https://static.usrfiles.com/ugd/01bc73_3b889e9c779e4eed92af27ca9bf2046c.pdf
- https://static.usrfiles.com/ugd/c1615c_83399d4a3e1c4d2f83922a10636b8a3b.pdf
- https://static.usrfiles.com/ugd/80fd5d_d1ccae3e63bc4535a6a132311dcb502b.pdf
- https://static.usrfiles.com/ugd/2813e2_1a27cb2d63f042bea14f5ed9000c2ba9.pdf
- https://static.usrfiles.com/ugd/1ee69b_1dfbcb72d4dd4bdc93118495070f75a3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004917.bin` `7f62f8ecea327c7d9dfb58b36fad08e635efb1ede4740a711e9ee149fdf3c173`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4917	5300 bytes
`font_01_sfnt_off00005b1a.bin` `ae6bbbb825b6c46fe66e59fad3577add5babaaaab192de52693e4d6350be967f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5B1A	12120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.