PDF malware analysis — malicious · af6b2243ac8cd1d1

MALICIOUS

PDF

40.2 KB Created: 2020-11-02 17:54:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 6caea6c52853a55b33974f19b6084173 SHA-1: 330959705a5da0ef805e0786771efc363605a7bf SHA-256: af6b2243ac8cd1d1c8fdca49145668b19ada526c2b4ec8145bb1fceba009b747

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which points to a known malicious redirector. The document body, though heavily obfuscated, contains text suggesting a lure related to job assessments, which aligns with the malicious link's keyword. The presence of numerous external PDF links further indicates a link farm or redirection strategy.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=indeed+assessment+answers+quizlet In PDF document text
- https://tigafuxofezez.weebly.com/uploads/1/3/4/3/134363272/1971191.pdfIn PDF document text
- https://tevumusavobe.weebly.com/uploads/1/3/4/1/134108657/wovufuzo.pdfIn PDF document text
- https://welofubevi.weebly.com/uploads/1/3/1/8/131856084/c6d7a4f7b729537.pdfIn PDF document text
- https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/854d3097ca.pdfIn PDF document text
- https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/tawekidaluro.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bisegilupuf/angus_and_the_ducks_marjorie_flack.pdfIn PDF document text
- https://s3.amazonaws.com/tadovu/zibefixuku.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a3115a8b-6590-4b8f-a0be-4becd1ae34fb/geduxege.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93f822fe-ee58-4110-8dd4-1df61ae19b14/tederorojoxoxelorotijiru.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd836f6c-e2ac-4e3a-8b17-672f0c111d5f/82011097096.pdfIn PDF document text
- https://s3.amazonaws.com/tibanepoxilibud/entrepreneurship_education_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/371e80cb-7f9d-4984-bcb2-3c3060bd40cb/13050451257.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0c8d781-6416-4f4a-a28f-80327ff03ea9/douglas_macarthur_elementary_school_indianapolis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000603a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x603A	5176 bytes
SHA-256: `efd69c7a74089968bcdf0e6fb85c3bf8c9977350e4d7024a2566b4b183ecd558`
`font_01_sfnt_off000071d2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71D2	9976 bytes
SHA-256: `4395eeb02df13961ba0b3ceebbe777e10340f6835f629855b6e39dd6e612e5cf`

Open this report in the interactive analyzer, or submit your own file for analysis.