PDF malware analysis — malicious · d397f95115094223

MALICIOUS

PDF

35.2 KB Created: 2020-08-30 11:03:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cf79178b4f7f4719dea81d5b23b0b3f5 SHA-1: 3d5f1a8a99f929b288f0981fea74cd504b54f251 SHA-256: d397f95115094223921ad8f69a70de324db519bf32a1e9145c26e3ead5d5e820

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link that points to a URL designed to lure users into believing they can edit PDFs. This link is part of a link farm, suggesting a broad phishing or scam campaign. The ML classifier strongly indicated maliciousness, supporting the assessment of a phishing or scam attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=edit+pdf+adobe+reader+x
- https://static.usrfiles.com/ugd/e1c37d_0f5e0a089a7145889e0d5d1de4053254.pdf
- https://static.usrfiles.com/ugd/868401_8cba29448e7947b3884ebf4662bd63d0.pdf
- https://static.usrfiles.com/ugd/b8c837_4badd7a6e6914a7394714745dbf4893f.pdf
- https://static.usrfiles.com/ugd/b8c837_90c7aff6dd964f1cb3dd8664412ccc6e.pdf
- https://cdn.shopify.com/s/files/1/0438/5567/5542/files/jisisomotejubabuwitinel.pdf
- https://cdn.shopify.com/s/files/1/0434/4017/7308/files/56896125691.pdf
- https://cdn.shopify.com/s/files/1/0446/6468/4697/files/365_facts_about_human_body.pdf
- https://cdn.shopify.com/s/files/1/0436/0149/4179/files/fefew.pdf
- https://static.usrfiles.com/ugd/5fd5c1_f997ce9761a84981a71c13421c5d0755.pdf
- https://static.usrfiles.com/ugd/b8c837_d2cebcae217b434ea6de0aeef9b1e0b3.pdf
- https://static.usrfiles.com/ugd/b8c837_85610b545a39410487a610b3e7dfc8c2.pdf
- https://static.usrfiles.com/ugd/b8c837_bec8430e06fd4bc1a8199ad3303ab3a3.pdf
- https://static.usrfiles.com/ugd/b8c837_407c605c881c44f1a4d6a1741ebced12.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004de8.bin` `c22c24b802ccd2dbb704a417029c7360379a3550c4b06a2e7c008fc86bde8643`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4DE8	4988 bytes
`font_01_sfnt_off00005ef0.bin` `48e57e8173611c30855b41e079644afbd874cd3c5953a92a1330e232f78d93bf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5EF0	9852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.