PDF malware analysis — malicious · 8d902fa1d1803f85

MALICIOUS

PDF

52.9 KB Created: 2020-10-28 18:43:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: c35f4cd5e112e6389aa972fb87f441e8 SHA-1: d353f3121af2a4377dc5e9bb41a9b5eff9d4a760 SHA-256: 8d902fa1d1803f850a18c5be4dbaed77a2209c88adf6db7ae21a40d5f5a5fddf

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, 'https://gettraff.ru/strik?keyword=mmd+model+download+hetalia', is flagged as a malicious redirector. The document also exhibits characteristics of a link farm, with numerous outbound PDF links, suggesting an attempt to drive traffic to potentially malicious or SEO-abused sites. The presence of a password archive lure heuristic indicates the document may be part of a multi-stage attack designed to bypass gateway security.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=mmd+model+download+hetalia In PDF document text
- https://zuzuxaze.weebly.com/uploads/1/3/4/0/134040629/benidutobipon-pujukevurevu-debutugalel.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373505/normal_5f8da5d9d3e8d.pdfIn PDF document text
- https://zavamemedu.weebly.com/uploads/1/3/4/3/134305249/wajovamiren.pdfIn PDF document text
- https://xujaxivef.weebly.com/uploads/1/3/1/4/131438557/jogojogil.pdfIn PDF document text
- https://dewubonate.weebly.com/uploads/1/3/4/4/134466502/vafujafigitu.pdfIn PDF document text
- https://kikuvabafot.weebly.com/uploads/1/3/4/3/134332304/efba26a.pdfIn PDF document text
- https://vakigosem.weebly.com/uploads/1/3/4/4/134480352/gugaxagavupir_vedorinedu_tuverokujitad_bepipa.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388432/normal_5f907c106396b.pdfIn PDF document text
- https://vuzevarezevarot.weebly.com/uploads/1/3/0/7/130740461/8108700.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369182/normal_5f8933ce9badd.pdfIn PDF document text
- https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/rolefajotar.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382784/normal_5f947dfb81393.pdfIn PDF document text
- https://kuromazu.weebly.com/uploads/1/3/2/6/132695519/besob.pdfIn PDF document text
- https://vevejeda.weebly.com/uploads/1/3/0/7/130776099/xexanoti.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/4472/4133/files/elmer_keith_sixguns.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/1979/6119/files/bucket_head_vacuum_attachments.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0486/3872/2206/files/45195462084.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/7372/3300/files/matulu.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/5016/3099/files/1925.pdfIn PDF document text
- https://s3.amazonaws.com/roware/6262457548.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0479/2395/3828/files/thin_film_transistor.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/4575/6821/files/fonctionnement_pompe_c3_a_chaleur_air_eau_daikin.pdfIn PDF document text
- https://s3.amazonaws.com/mipeboro/aplastic_anemia_journal.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_006_off0000a96b.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xA96B	18228 bytes
SHA-256: `4c461dedcb327842c61cc104eb5c4eab83167750e753720e159aa100a89395e3`
`font_00_sfnt_off000063a5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x63A5	6744 bytes
SHA-256: `b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808`
`font_01_sfnt_off0000748a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x748A	4888 bytes
SHA-256: `a5e546e730cf0905345d2158de7a69b6c54f4f96b002142960f22857b70db831`
`font_02_sfnt_off0000851a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x851A	10636 bytes
SHA-256: `5e49f73b8017b69e7a859a3a150867aa2943a60f01283ff6050535e75c78fc48`

Open this report in the interactive analyzer, or submit your own file for analysis.