PDF malware analysis — malicious · a4851e1db3dd818d

MALICIOUS

PDF

49.9 KB Created: 2020-10-17 00:35:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26

MD5: 187afe6d812241f57e3bd9cb7e30afb2 SHA-1: 28454b35dc1f337412222d769e7d3f51bf7d5f8b SHA-256: a4851e1db3dd818df4e17f7b67fcf889e0eeacae2f72a149e9cfdf23c85a2768

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link, pointing to 'https://cctraff.ru/strik?keyword=se+laver+les+cheveux+%25C3%25A0+l%2527argile'. Additionally, the document exhibits characteristics of a link farm, embedding numerous external PDF links, one of which is also identified as a potential redirector. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious redirector attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=se+laver+les+cheveux+%25C3%25A0+l%2527argile In PDF document text
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f8717d44cd10.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366010/normal_5f86fe659cdb6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367622/normal_5f895021f00ee.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369330/normal_5f8a09efb42ae.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365599/normal_5f890e6df129b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f88ae6d5e024.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://uploads.strikinglycdn.com/files/20c5477d-5d6f-4c17-b517-437655d369a7/cambridge_igcse_ict_teacher_guide_pd.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c647f97b-1044-4d1b-80fb-6310e43c2364/mimudewejojejelularutaf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1761802b-ae6f-40b2-b070-7e0fe8604090/rukalekazolugokorowora.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1864b3b1-2fed-41a0-b227-8f7b1b0cdb1d/new_hampshire_vodka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4881cc57-1ac6-4610-a892-8efd3640cbb8/pevizavegusolinizegu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b85f3c91-7c43-4184-a148-3df887fde486/wopajudademuvivadam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eadaa14b-d37b-4bf7-a5d1-faf271a48fbe/58690880729.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb600631-1afe-4e33-8d3a-38b5e213c5e5/walaku.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/080aeea3-9919-46c3-822a-c2e29f227b85/57275167962.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9613a8fb-b8a5-445f-ac55-e1a30c18247c/95172616946.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51b35787-3fd2-4171-98d1-90bf4d8380a9/18953107583.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/5004/8921/files/kinds_of_chemical_bonds_worksheet_answers.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/7897/4629/files/sikajunekugobap.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8540/7421/files/69625168103.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0478/7952/0422/files/nukinolagawupedolimukomu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006f5d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F5D	5560 bytes
SHA-256: `c2c193d5e9d92a90c2272e3a7230f03681299d927e71c3d144d39a270f6c6fcf`
`font_01_sfnt_off000081b0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81B0	6148 bytes
SHA-256: `149738eb3e1d0bfb4a5732e89a115965e6f0cf3fc4971c694d3ce3619176544d`
`font_02_sfnt_off0000918f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x918F	12520 bytes
SHA-256: `b8e64b39d0fd4b0dee877a80b45c642ef59b1f67684083364cdd75be0f3c0025`

Open this report in the interactive analyzer, or submit your own file for analysis.