PDF malware analysis — malicious · b1e68aecdfa0546f

MALICIOUS

PDF

36.6 KB Created: 2020-09-09 02:44:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 147aefe13d7ba5899b96cdb66d1f6f7f SHA-1: ffdbb0e68e508ca671458969f3d9ec83abeee56b SHA-256: b1e68aecdfa0546f51613dcd173ba8ac96b97afe3b1ccbd83134e28ddf3f0377

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to static.usrfiles.com, which is identified as a link farm. One of these links, 'https://ttraff.club/wix?keyword=breath+of+fire+iii+psp+iso', is flagged as a malicious redirector. This suggests the document's primary purpose is to direct users to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=breath+of+fire+iii+psp+iso
- https://static.usrfiles.com/ugd/badafb_afd49e244bd2466c982aa4cacc35a70f.pdf
- https://static.usrfiles.com/ugd/f3cb45_930889076f884c9fa88ae20a67965778.pdf
- https://static.usrfiles.com/ugd/8cbfce_a67f2849b8864f6988e8adcec801646c.pdf
- https://static.usrfiles.com/ugd/2f8cea_ff95ad7d0b7b4084bcbccac1cf647b9a.pdf
- https://static.usrfiles.com/ugd/b8c837_07194948e0f94b1e95d745f6ae29c3ba.pdf
- https://static.usrfiles.com/ugd/daca0d_b50aca014eb2499abfdc6d3ab5e23aef.pdf
- https://static.usrfiles.com/ugd/f6a907_43f71c6474cd433aaf17cfad1d190b7f.pdf
- https://static.usrfiles.com/ugd/097bd5_d9eab28923dc4a2da94e3a68639c7d2b.pdf
- https://static.usrfiles.com/ugd/b8c837_3a1035ac50134c5da3e49d72c27d05b6.pdf
- https://static.usrfiles.com/ugd/40336e_573977ee4e634d9895d470608cd84926.pdf
- https://static.usrfiles.com/ugd/cf5aa9_15f706afcb6e4c8b902fd0dca3951d9a.pdf
- https://static.usrfiles.com/ugd/5a4aad_0d21b3ac38704ce6a92e1ee0c3b2cc9d.pdf
- https://static.usrfiles.com/ugd/158fb9_476302c4c86d4706a266e396f3499156.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005210.bin` `e24fdd6c579e5fb2576a13831ac1da528d36ed4db79ac79c80d7b3634ebc0716`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5210	5008 bytes
`font_01_sfnt_off00006314.bin` `2f00af7fad5a67df3a68208c8de8ad8ff43944c12bcb530a06ed8c269b3b1873`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6314	10136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.