PDF malware analysis — malicious · d3c605c6c8170ea0

MALICIOUS

PDF

41.6 KB Created: 2020-08-31 05:07:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 159fb8a6946262594c75f19995e57eba SHA-1: be4019e253d2cf84416f937169ea9aa456762734 SHA-256: d3c605c6c8170ea054949a3febc81f00d591b6361ac7a8cab94ffbe8d2e6093d

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains numerous embedded links, including one pointing to `https://ttraff.ru/wix?keyword=minecraft+crafting+game`, which is identified as a malicious redirector. The document body, though heavily obfuscated, appears to contain text related to Minecraft and the URL. The presence of a link farm and a critical heuristic firing for malicious redirectors strongly indicates a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.ru/wix?keyword=minecraft+crafting+game
- https://cdn.shopify.com/s/files/1/0435/3123/9588/files/pelozeranu.pdf
- https://cdn.shopify.com/s/files/1/0439/6358/0574/files/5439525057.pdf
- https://cdn.shopify.com/s/files/1/0433/4754/2165/files/kidarurokuxirik.pdf
- https://cdn.shopify.com/s/files/1/0448/5398/5442/files/neural_networks_and_deep_learning_pat_nakamoto.pdf
- https://cdn.shopify.com/s/files/1/0430/3201/9097/files/70662792945.pdf
- https://static.usrfiles.com/ugd/756799_8cf6132667a74e5696f807ce03d50068.pdf
- https://static.usrfiles.com/ugd/e5a943_ac2c1a829806464ba62a3026f58b01bf.pdf
- https://static.usrfiles.com/ugd/be19e1_135406ba344f464aa4e30a743836abfc.pdf
- https://static.usrfiles.com/ugd/07ef24_b75f6f47af7e477d986faff72c473a10.pdf
- https://static.usrfiles.com/ugd/83e24f_e813263656a945bc8d5c72a3b0f272ec.pdf
- https://static.usrfiles.com/ugd/b8c837_f6ba4b36a0154c989d0c4a13047bd913.pdf
- https://static.usrfiles.com/ugd/c3548c_3db2ab6077cc43d0897a47104b7afc5b.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000652a.bin` `ad7ce7bcc95c643b4de5b12d6d4b314066c27d62f82ff564fcd33b2cf66de254`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x652A	4996 bytes
`font_01_sfnt_off0000761a.bin` `7ad0ee2332f7ab1b568d0f34b8f8de6cadf50a955baebadcf41a65e5308ce987`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x761A	10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.