PDF malware analysis — malicious · bd3c50f9bede0dbc

MALICIOUS

PDF

97.5 KB Created: 2020-10-21 10:13:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 0e804d9838bce75e30f1aa71af2a328c SHA-1: 3048eb53d300b25396c8b770ab2c9b5f16f1dc33 SHA-256: bd3c50f9bede0dbcfd25f9ba83b866bbca6f6162c5f54c9376047a0d1e4a185e

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for linking to known malicious redirector infrastructure, specifically pointing to 'ttraff.link'. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a PDF download. The presence of numerous external PDF links further suggests a link farm or SEO manipulation tactic to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/123?keyword=histoire+de+la+civilisation+fran%25C3%25A7aise+pdf In PDF document text
- https://cdn-cms.f-static.net/uploads/4375088/normal_5f8f8e47c75d3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367305/normal_5f8e484ebc9e5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387808/normal_5f8db8a5754ab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366302/normal_5f870ddde02c9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366982/normal_5f8a1af05bf0d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375200/normal_5f8f2601f3566.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365649/normal_5f8fa0cc12e30.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/tetazino/penyebab_abortus.pdfIn PDF document text
- https://s3.amazonaws.com/memul/protocolo_ii_adicional_a_los_convenios_de_ginebra.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/5949/2517/files/figure_of_speech_book.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0431/3956/3686/files/complex_numbers_ncert_solutions.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0266/8583/3416/files/tededefuxinakaxagepiso.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/4141/4555/files/gurbani_books.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/4756/2645/files/zewasokizepozoxeduta.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/82316e19-7cf0-4704-a020-51743fc8b1ad/57575281617.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4639f26e-cf4e-4dc9-9d9c-976d4c86ac3a/21444593226.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/19dbf85a-3de9-495f-9cb0-bc24e16fd1f9/kotuxalififinip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a15ab71f-2679-49a2-82c7-1c4659da24d0/76820520242.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a9d30f7-daa7-47a4-bbf0-3948568848a9/86800833393.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/7845/0840/files/lakers_stream_reddit_buffstream.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/9925/8022/files/alimentos_organicos_definicion.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012fc5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12FC5	5140 bytes
SHA-256: `c8b09fea70b33037edfa0182608ecf09c6434ce10181dbe7cd7955c0a23ebd24`
`font_01_sfnt_off00014102.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14102	12592 bytes
SHA-256: `95c1b938c2c47dbcb0c1714eb22071e2da3f7c9c859b76a6a94e3969ff2a451a`
`font_02_sfnt_off000167cb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x167CB	4324 bytes
SHA-256: `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`

Open this report in the interactive analyzer, or submit your own file for analysis.