PDF malware analysis — malicious · d94ebb760cc37637

MALICIOUS

PDF

32.6 KB Created: 2020-09-09 08:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 38c3ec4819a38c0e5c19c3817cf98fad SHA-1: e326d314b6f91c7be156f8bfe1397b6f53242b2a SHA-256: d94ebb760cc3763778c72344fb540f22d039a917695e8c68e58bfce1238faebb

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The ML classifier also flagged this PDF as malicious. The document body contains text related to a video and links, suggesting a lure to a malicious site. The presence of numerous external PDF links indicates a link farm strategy, likely for SEO poisoning or to distribute further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.link/pify?keyword=barnabas+washa+video
- https://static.usrfiles.com/ugd/ea9bdf_0c033afe072b412286f214c7045d7bef.pdf
- https://static.usrfiles.com/ugd/f14cf6_b074f81bb73d48da84cad35886ccfa28.pdf
- https://static.usrfiles.com/ugd/5360f8_74bde3425737458b807a9f37e2028b85.pdf
- https://static.usrfiles.com/ugd/2ca09c_4f24669e1cfc48a0bde73315794de8d4.pdf
- https://static.usrfiles.com/ugd/b8c837_ad68fca67e90411aa6ce471b0df2e011.pdf
- https://static.usrfiles.com/ugd/5899d5_86b91d18e3c94fac8357de7c9c2e6e19.pdf
- https://static.usrfiles.com/ugd/9e53d4_340f5d557c5e4778aa62c68d3db9612e.pdf
- https://static.usrfiles.com/ugd/2b25b5_2f7b88bdc8a54aaeb2fdd64ff936a788.pdf
- https://static.usrfiles.com/ugd/b8c837_c951c817625f4eaab032288f870db976.pdf
- https://static.usrfiles.com/ugd/cf5aa9_e65218fde45e4ede880f997a76554dfa.pdf
- https://static.usrfiles.com/ugd/e4d7df_1a3c42c905cc4b1889ae5813c5047ec6.pdf
- https://static.usrfiles.com/ugd/f9fac6_754a59b883144b74bb2e56e8cd967225.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000417f.bin` `b5502dac96b9bb8cd1586084cfc64a9f96bd587b3e6e47c9a0361bcc604f2eac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x417F	5224 bytes
`font_01_sfnt_off00005350.bin` `3d911f221f6aaef2fec5c9e4cac69fd3c70202d968cbc83c5a96801b8f4db79a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5350	10044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.