PDF malware analysis — malicious · b23518eb2ca24000

MALICIOUS

PDF

37.2 KB Created: 2020-09-03 21:54:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d24f5509f8f63549843e36a9efdda999 SHA-1: 3470ea03c812c8b0882421b9d78115ef2b5e06f1 SHA-256: b23518eb2ca24000d6fc0b0d961ab5e0ff769d62ca29ac2bbd4633e195932505

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous links, including one pointing to a known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text related to a 'Gemini man review' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/wix?keyword=gemini+man+review+hollywood+reporter
- https://static.usrfiles.com/ugd/9ff9b8_3a8681054c57467aaa7de9c945274207.pdf
- https://static.usrfiles.com/ugd/1813b3_d5ad547a38af4109b18bdbbb813a9f5f.pdf
- https://static.usrfiles.com/ugd/9bd82e_46df7e0368e644ce82ffdf4b4a519f65.pdf
- https://static.usrfiles.com/ugd/5c7528_b84c742c00b24017a127b96f89b93556.pdf
- https://static.usrfiles.com/ugd/ecd213_298f6713d95949ebbdd55395937e1a32.pdf
- https://static.usrfiles.com/ugd/dcc11b_929fe24b5b604e6090a97c2717b9230f.pdf
- https://static.usrfiles.com/ugd/79e5df_c03c0cab49fb4bc2a2a687314938d75e.pdf
- https://static.usrfiles.com/ugd/9c0842_1ae22651dd5b4bd195a1af6db2335d79.pdf
- https://static.usrfiles.com/ugd/ed8107_c61225eeb1914f769ccaa8e89a9f519d.pdf
- https://static.usrfiles.com/ugd/8acad3_96e91ea286e34f4991c6ddafeeb47dfc.pdf
- https://static.usrfiles.com/ugd/10a4aa_862caabae15e4d2bb8d6964ac5ce1a0d.pdf
- https://static.usrfiles.com/ugd/95b9ea_fb780a165f484a37984d85516e82231a.pdf
- https://static.usrfiles.com/ugd/02beb7_99d6dc731c364b0283b9b903e3312966.pdf
- https://static.usrfiles.com/ugd/d5d855_5ae947416eb94dd3ab44d304dde8dc4e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004e6d.bin` `ccb365385b2482837588059a6225b5187bef713a756fd17cc0ca737caf92bc8c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4E6D	5308 bytes
`font_01_sfnt_off0000606a.bin` `392037a39af742fc67be92218d212c70e0b6f126f3021cfb28d4b824f8e0e467`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x606A	12156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.