PDF malware analysis — malicious · b362d0330c67ab3a

MALICIOUS

PDF

61.1 KB Created: 2020-08-30 00:23:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2b9dc8f41f1cfe41f2095eb4bbbc59c4 SHA-1: fe3fffdd16693584ddd1241de8152bd91d7da040 SHA-256: b362d0330c67ab3aca7a1530eb80896b9d11f40f73c9834acdbfed7e49da3b41

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many pointing to Shopify domains, but one critical link directs to a known malicious redirector. The document body, while heavily obfuscated, contains the title 'Teoria da conduta direito penal' and the malicious URL, suggesting a lure to a phishing or malware distribution site. The ML classifier strongly supports the malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=teoria+da+conduta+direito+penal
- https://cdn.shopify.com/s/files/1/0432/7433/8472/files/mevemudat.pdf
- https://cdn.shopify.com/s/files/1/0430/5253/1869/files/udi_manber_introduction_to_algorithms.pdf
- https://cdn.shopify.com/s/files/1/0444/8839/2871/files/what_is_origin_in_git.pdf
- https://static.usrfiles.com/ugd/1f5cef_777a3edc8a0440909e4b0aff3060a8ae.pdf
- https://static.usrfiles.com/ugd/b8c837_71baf34b07de4a609da323efc26e6da5.pdf
- https://static.usrfiles.com/ugd/b8c837_0cdca71efa4d420dae24df829404ce47.pdf
- https://static.usrfiles.com/ugd/912de2_8c2a85fbde344bd6b2127d5bd2ec7111.pdf
- https://static.usrfiles.com/ugd/ae059d_44ad7335903749459badcbb2ee5d6fea.pdf
- https://static.usrfiles.com/ugd/4dd980_b0ca2ab02a9a477a802d125da28b1cab.pdf
- https://static.usrfiles.com/ugd/10e3af_dd18b63ea6f04f15aeb2f6a62940feea.pdf
- https://static.usrfiles.com/ugd/ce0e6d_dcde245d85634fc3872a98b793ec7c09.pdf
- https://static.usrfiles.com/ugd/b8c837_34613afffee84039b3d31d112bd4837f.pdf
- https://static.usrfiles.com/ugd/756799_d6645455b02543a49ea356bb6dd36f10.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ade5.bin` `d996647f100adc8bb3776027567d51fc911379e5406612df9dcc3bf4e8331437`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xADE5	4840 bytes
`font_01_sfnt_off0000be5f.bin` `0d157b904e44c4ffa6a79fa3de6708629e400054f4aa5c727575aaa49f070bfa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBE5F	13552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.