PDF malware analysis — malicious · b1daa3f0b023524d

MALICIOUS

PDF

43.0 KB Created: 2020-10-25 17:44:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15

MD5: 918d9579210c5e317d5df8a41529d63f SHA-1: 8dc2e360adca12b257a8b02c5eebb0a0be8e972c SHA-256: b1daa3f0b023524d4a819be3579069121c05cfc2a8230b87625297e3d548370e

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded links, many of which point to a link farm infrastructure designed to redirect users to other sites. The primary redirector URL is https://ggtraff.ru/aws?keyword=basic+electronics+and+communication+engineering+notes+pdf, which is flagged as malicious. This suggests the document is intended to lure users to potentially harmful content through a deceptive SEO-based link farm.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=basic+electronics+and+communication+engineering+notes+pdf In PDF document text
- https://cdn-cms.f-static.net/uploads/4378404/normal_5f8f8638a829d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382406/normal_5f904ac644fee.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f87528cb0819.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380214/normal_5f93cd85226a2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372383/normal_5f93dbad3a8f0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369933/normal_5f88adbacf070.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376096/normal_5f94b3091fbbd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369654/normal_5f8825d3ce32d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375525/normal_5f89c1e15f46f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0483/7130/2553/files/96210548921.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/6190/3005/files/76119406770.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0476/9366/0326/files/sindrome_da_arteria_mesenterica_superior.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/3544/9238/files/raspberry_pi_n64_performance.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0483/5849/0275/files/medicare_non_contact_infrared_thermometer_instruction_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4926afa9-318a-4076-b4b2-6b38640f3239/vadul.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7ff5f42-29ea-42a6-bd57-b0e5bb0ab43f/37229881570.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29981150-291c-47e0-95b1-9519ae00ca18/easy_boomwhacker_songs_for_kindergarten.pdfIn PDF document text
- https://s3.amazonaws.com/tuzakifezara/87667378512.pdfIn PDF document text
- https://s3.amazonaws.com/pewibim/water_pollution_short_notes.pdfIn PDF document text
- https://s3.amazonaws.com/mijedusovineti/jagebamisetolakotowofapoj.pdfIn PDF document text
- https://s3.amazonaws.com/minaxigevani/amsterdam_central_station_map.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/8200/7199/files/69837436976.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/9042/0914/files/jibalogiw.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000580b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x580B	5404 bytes
SHA-256: `9373b321e1c6a90704a68608fce7c83133d64adb336b1ba46cec29ca84b3ab7b`
`font_01_sfnt_off00006a46.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6A46	10456 bytes
SHA-256: `2211d0f5f94a196df6ec42227e2899454cc1ec8eae0a13dcb1b514dbb822c51c`
`font_02_sfnt_off00008e11.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8E11	4324 bytes
SHA-256: `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`

Open this report in the interactive analyzer, or submit your own file for analysis.