PDF malware analysis — malicious · da613bf5899a1b5d

MALICIOUS

PDF

43.4 KB Created: 2020-10-26 03:48:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: a5d205305f37a4d552ce3cdb1adb9522 SHA-1: 8882796ca25bef83bfff1fb5d1488dfe67ed7e5a SHA-256: da613bf5899a1b5d3d9dab56c890d9747f59d1951872b0d9d04556b5ed7d080a

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a link to a redirector URL that ultimately leads to a download for a "best tube downloader apk", indicating a lure for potentially unwanted or malicious software. The presence of a "download button" heuristic further supports this phishing-like behavior. The ML classifier strongly flagged this PDF as malicious, suggesting it's part of a larger malicious workflow.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=best+tube+downloader+apk In PDF document text
- https://cdn-cms.f-static.net/uploads/4369771/normal_5f87fb338f9db.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4391636/normal_5f920b3b97e4b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4377115/normal_5f8f6ad36639c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376374/normal_5f94d90a8fe0b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387419/normal_5f8d7bd23f27c.pdfIn PDF document text
- https://degujipimisa.weebly.com/uploads/1/3/1/4/131453395/fawivilipoliv_pumovaxuludif_murorabalunafa_karopasaloz.pdfIn PDF document text
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/7d574c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/henghuili-files2/6th_grade_math_exam.pdfIn PDF document text
- https://s3.amazonaws.com/dutimajizowa/zezutanosarulopopamupabex.pdfIn PDF document text
- https://s3.amazonaws.com/vuraradaso/92130871612.pdfIn PDF document text
- https://s3.amazonaws.com/gifiz/70994208797.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0501/7029/8529/files/alice_and_wonderland_book.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/5366/2876/files/netufetok.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/5043/4211/files/o_mundo_de_sofia_companhia_das_letras.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0435/5555/3432/files/iron_kingdoms_fillable_character_sheet.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0504/5020/2814/files/xuzopozi.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/1412/7271/files/their_eyes_were_watching_god_horizon_symbolism.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/8115/7787/files/eisenhorn_xenos_omnibus.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0506/7171/4491/files/rerovunagufofiba.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/1690/3585/files/17887747176.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ecf9e258-42c4-4448-8c37-8170ae83350f/50940082248.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb9d2d81-94ec-4dea-a3d1-6ae179c7fbe7/jegevajaro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f63293f-5a5f-4aeb-b2ed-5c0d048e0f7f/49485082492.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2da56335-590b-4196-99f4-99222b08c6ad/givaloxijemulawi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ae9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AE9	5296 bytes
SHA-256: `b2638bac55d3b03f27d849b78fa5a85a19643856e30fdfa1779930a1346021c1`
`font_01_sfnt_off00007d06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D06	10396 bytes
SHA-256: `b274ebfe3f4457aacd4c07f5fda6270c6b71e01a9de4a9b1de45e6227a16fde4`

Open this report in the interactive analyzer, or submit your own file for analysis.