PDF malware analysis — malicious · b474ed2d12f6daa9

MALICIOUS

PDF

92.9 KB Created: 2020-09-01 17:09:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d4abb28da9b0c6028fd827729b504481 SHA-1: 2a7ac5f58a658d32953b63db52ca61bdd62dd17f SHA-256: b474ed2d12f6daa91eecc499ca1e8bc311306c454ee1c69af71acbfa5f8d6088

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF file contains a significant number of embedded links, identified as a link farm, with a primary malicious redirector URL. The ML classifier strongly indicated maliciousness. The document body, though heavily obfuscated, contains the malicious URL, suggesting a lure to external content. The presence of a malicious redirector points towards a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.club/wix?keyword=anticoagulant+guidelines+pdf
- https://static.usrfiles.com/ugd/e3ff21_52ae16b5344b4617bc566de7d43ebd43.pdf
- https://static.usrfiles.com/ugd/9f6a24_a45833bb619e471fa36417c2bb99e790.pdf
- https://static.usrfiles.com/ugd/b8c837_762337e21b2b4b40bb75596da384d484.pdf
- https://static.usrfiles.com/ugd/e7e4a0_208f49f5193049f99bb89ab397aa1586.pdf
- https://static.usrfiles.com/ugd/e3ed1f_7419136edfea49c59e7f266bf387334c.pdf
- https://static.usrfiles.com/ugd/8ab72e_1bcd0dd4da8b4efdac221495eb8329c2.pdf
- https://static.usrfiles.com/ugd/23e9be_fdaa8d2f74774584b876754bb6ca832e.pdf
- https://static.usrfiles.com/ugd/1fbf8b_20e48ab77f59489ca1e1ab3c823e074e.pdf
- https://static.usrfiles.com/ugd/b8c837_c7a1767b0ebf4c67a7d7807bdf1b2781.pdf
- https://static.usrfiles.com/ugd/afe78f_ccbc39e015bd4768bb85df062144f8ec.pdf
- https://static.usrfiles.com/ugd/f967ac_8dd09e7791cb4c90b6d15b1d34a59bc8.pdf
- https://cdn.shopify.com/s/files/1/0431/5083/5876/files/fefigulisuzebezajof.pdf
- https://cdn.shopify.com/s/files/1/0438/1881/1552/files/ecological_balance_in_nature.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012d02.bin` `da2fadb638f8ae1be2dc2aafbc14acc5539c7ba702fb3c4f94517a3bd5ba1681`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12D02	5216 bytes
`font_01_sfnt_off00013edd.bin` `8a6071dc21923f7eea4bba41c4f42c95ce7d05e5d9f2337409e48d86e7166097`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13EDD	12360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.