PDF malware analysis — malicious · 9f4d02bae019411f

MALICIOUS

PDF

72.3 KB Created: 2020-12-26 21:43:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 088b537a5b9cf190dde7dbe89ec93947 SHA-1: 13c4c5b13f1bb36b1f7784107974aca90ae6f75d SHA-256: 9f4d02bae019411f08c0a81c60b5b9efd6951b11692d27c7210e7f37482e4050

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a link to a redirector URL that is associated with malicious activity, likely to facilitate the download of further malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external PDF links, suggesting an attempt to create a link farm for SEO manipulation or to distribute multiple malicious files. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?utm_term=ski+safari+2+game+free+download+for+android
- https://cdn-cms.f-static.net/uploads/4405922/normal_5fa8673d88094.pdf
- https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/tamivejogu-fipurigewa-rofeku.pdf
- https://tusidotug.weebly.com/uploads/1/3/4/4/134482214/3955f57bbf6795b.pdf
- https://cdn.sqhk.co/semegopo/jhcSSon/16000837063.pdf
- https://cdn-cms.f-static.net/uploads/4367940/normal_5fdae16a12c93.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/mogipegi/11488682600.pdf
- https://s3.amazonaws.com/pibabopuduj/zumalin.pdf
- https://s3.amazonaws.com/dojonuta/8156032873.pdf
- https://s3.amazonaws.com/tifuwuw/94625808323.pdf
- https://s3.amazonaws.com/kofabube/liwigolakapivatogixeji.pdf
- https://s3.amazonaws.com/mizeteb/bodybuilding_exercise_schedule.pdf
- https://s3.amazonaws.com/rebesudanolo/emotional_behavioral_disorders.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dd0e.bin` `fdbaedde7e057ba7bc11bfcaa3cd97d5e4205d253b31acfdf605ff538a03536a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD0E	5616 bytes
`font_01_sfnt_off0000f029.bin` `7f53668c1e5d391c0f4ac06fd3a8cc7eee4f026018bbb6116ffcaa630c66ed72`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF029	10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.