PDF malware analysis — malicious · 8e1559ef64eef586

MALICIOUS

PDF

65.4 KB Created: 2020-11-06 16:34:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7aa2285d671a59d2b9a185ec6eb52302 SHA-1: 6c1d228a7f5263087e96fb694c2b64f9cf94d00a SHA-256: 8e1559ef64eef586aaf99cdc131cc2091dc81d2ae33af134a021074069b79879

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to PDF files, suggesting a link farm or SEO manipulation tactic. One prominent URL, 'https://trafffi.ru/aws?keyword=different+types+of+led+flashlights', is embedded within the document body, indicating a potential lure for users to visit a malicious or scam website. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?keyword=different+types+of+led+flashlights
- https://cdn-cms.f-static.net/uploads/4367289/normal_5fa383b80d0dd.pdf
- https://cdn-cms.f-static.net/uploads/4366384/normal_5f8e0849a24d0.pdf
- https://cdn-cms.f-static.net/uploads/4379054/normal_5fa512d9a4bb8.pdf
- https://cdn-cms.f-static.net/uploads/4393883/normal_5f9135aa2ecf2.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f8946d498689.pdf
- https://cdn-cms.f-static.net/uploads/4369518/normal_5f91d3772ddbe.pdf
- https://cdn-cms.f-static.net/uploads/4377095/normal_5fa1b8061c046.pdf
- https://cdn-cms.f-static.net/uploads/4376126/normal_5f909edb4a76c.pdf
- https://cdn-cms.f-static.net/uploads/4418001/normal_5f9bd2461917e.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://vadazigifexe.files.wordpress.com/2020/11/gopiv.pdf
- https://s3.amazonaws.com/levumoduf/nobewijibaxikegetugi.pdf
- https://s3.amazonaws.com/jewizopukuni/vikokemenoxanadaxudebim.pdf
- https://ribowazakas.files.wordpress.com/2020/11/97689997320.pdf
- https://dejubanev.files.wordpress.com/2020/11/70554114610.pdf
- https://s3.amazonaws.com/dutuzanob/xosun.pdf
- https://suvarofora.files.wordpress.com/2020/11/lodebukiworidu.pdf
- https://s3.amazonaws.com/betimugi/pro_go_tv_app.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c10b.bin` `1b33b1b68ec22b6c9207e82d9167ca5b91f85a5e1d4c38fc673810781ce04b1f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC10B	5404 bytes
`font_01_sfnt_off0000d37e.bin` `d04a93d6e9ae7a766213a35b1c7a139f449df93636fb76c23184b0ccc5cf1395`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD37E	10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.