PDF malware analysis — malicious · d5a998748d633f5d

MALICIOUS

PDF

43.3 KB Created: 2020-08-30 05:59:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 231224b780130e8b2aa15a9bfb1bcc0e SHA-1: d17ce94719ec9d58ae6d3690c71dd85f89d17bfb SHA-256: d5a998748d633f5d5a69fe9d0227b31799d231d4355e81e66ed52b33a16ec8b5

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded links, identified as a link farm. One of these links, 'https://ttraff.com/wix?keyword=similaire+que+biseca+chaque+comme+un', is flagged as a known malicious redirector. The primary purpose appears to be directing users to malicious or unwanted content through this extensive link network.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=similaire+que+biseca+chaque+comme+un
- https://static.usrfiles.com/ugd/ade4e6_de07b3de755d4274a752b95adeaa0dcc.pdf
- https://static.usrfiles.com/ugd/b8c837_38cd90dd58504d1fadfffde7be757e50.pdf
- https://static.usrfiles.com/ugd/ea78e0_bc76c024fbb04d03add1e9177eb60af5.pdf
- https://static.usrfiles.com/ugd/b8c837_64fdc05f990244a88cfaf2ad78b8893c.pdf
- https://cdn.shopify.com/s/files/1/0427/8714/3839/files/37504758221.pdf
- https://cdn.shopify.com/s/files/1/0429/8866/7034/files/kolidixaseniru.pdf
- https://cdn.shopify.com/s/files/1/0440/4019/2150/files/shutter_island_putlocker.pdf
- https://cdn.shopify.com/s/files/1/0428/8220/3801/files/tuxuj.pdf
- https://cdn.shopify.com/s/files/1/0462/3853/1738/files/motorola_droid_bionic.pdf
- https://cdn.shopify.com/s/files/1/0427/5198/3772/files/mabovedub.pdf
- https://cdn.shopify.com/s/files/1/0437/6972/5080/files/cadet_recruitment_2020_application_form.pdf
- https://cdn.shopify.com/s/files/1/0433/6726/8517/files/xaleginajufebusog.pdf
- https://cdn.shopify.com/s/files/1/0431/1787/1265/files/alvaro_siza_book.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006590.bin` `d1adf8430d037963c90ab0fe06dd624bf24a03b581d1fee0391d6d64d11e952c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6590	5408 bytes
`font_01_sfnt_off000077be.bin` `ec84c27b441a6df2676dd76b781da5527de83a104c1ebbc6520106583c757c35`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77BE	12456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.