PDF malware analysis — malicious · 911360c6e068d1b2

MALICIOUS

PDF

40.9 KB Created: 2020-09-01 23:03:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 31663bbf1cb5513255d7706038026e64 SHA-1: 720680a598f9c3a92d9a9191434ec235e0cd0cda SHA-256: 911360c6e068d1b2f962ba250d391ea38775a0ad9a9cdb28c3eea7643608fe90

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains multiple embedded links, with one specifically identified as a malicious redirector pointing to 'https://ttraff.com/wix?keyword=arrl+handbook+2019'. The document body, though heavily obfuscated, contains references to this URL and other PDF files hosted on 'static.usrfiles.com'. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=arrl+handbook+2019
- https://static.usrfiles.com/ugd/9c43ec_a00aad913b604d25a29b3e19558bc1a8.pdf
- https://static.usrfiles.com/ugd/b8c837_4641cd3f38434792bf12e4f0fd3a7cff.pdf
- https://static.usrfiles.com/ugd/b8c837_5256334a210048ee94a97f102978c2ba.pdf
- https://static.usrfiles.com/ugd/0f5b72_96a1fa2b3d63448b9eedd0c295b8aa49.pdf
- https://static.usrfiles.com/ugd/739437_fba4a99b29fa461da4e3dc5ad2da05a8.pdf
- https://static.usrfiles.com/ugd/5be868_eade56b07a024674ba52c1869fa0290b.pdf
- https://static.usrfiles.com/ugd/a31856_3628ed5a0c4e4117b928b3ff520b5183.pdf
- https://static.usrfiles.com/ugd/7baf93_24decd35e31845ff981bc107d93e0199.pdf
- https://static.usrfiles.com/ugd/b8c837_9fc63c1e41314684a53ebc2737f0a5e2.pdf
- https://static.usrfiles.com/ugd/b58d21_740e86c2f7f041b49ee208eeafcb078c.pdf
- https://static.usrfiles.com/ugd/b8c837_ef49ec6bf39c4bb486bb80f5e5d64998.pdf
- https://static.usrfiles.com/ugd/078c79_df9eeae1fd33400dbcb94cc327928f30.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006192.bin` `1d9ddb9b11db9757c93e04f869ee2e7106dd63dce6354e9ea445b0eb778f7102`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6192	5408 bytes
`font_01_sfnt_off000073ed.bin` `84733a10715532b1fbe0c51c65e56aaa48ba587234b2459dfbbbc052fbfbffe2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x73ED	10356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.