PDF malware analysis — malicious · dcbf43a352f36a44

MALICIOUS

PDF

154.3 KB Created: 2020-10-28 06:06:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b748ee3e0a448d8d692655b68e61f5c7 SHA-1: 7cd77e004ad34684bed4dba6b8fabc15717f3ddd SHA-256: dcbf43a352f36a447ad6027bfae7f68f9716452287de31ec586415c5ec4df962

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link, pointing to 'https://ttraff.cc/123?keyword=cube+world+wiki+chocolate+donut'. This URL is the primary indicator of malicious intent, suggesting the document is designed to lure users to a compromised site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=cube+world+wiki+chocolate+donut
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/bomoworejitin-jijuvu-dinavo.pdf
- https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/govodijix_jarelu.pdf
- https://sajosapisede.weebly.com/uploads/1/3/4/3/134344890/579072.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/8655217.pdf
- https://mijisurux.weebly.com/uploads/1/3/1/0/131070147/3166684.pdf
- https://mitemulesebiped.weebly.com/uploads/1/3/4/4/134479511/12e69c7fa26502.pdf
- https://rajomiluti.weebly.com/uploads/1/3/2/6/132682989/63e6123097d7.pdf
- https://jesasifewom.weebly.com/uploads/1/3/1/4/131453969/butalusagu.pdf
- https://buvusujekigipo.weebly.com/uploads/1/3/4/4/134453925/zulofab.pdf
- https://rosikotukixaru.weebly.com/uploads/1/3/4/3/134312973/05d3f.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/688e6011-519c-4599-aaaf-6d6c0687edcb/7169073492.pdf
- https://uploads.strikinglycdn.com/files/66469c7a-4b49-4259-b385-64746bc748a3/7592072174.pdf
- https://uploads.strikinglycdn.com/files/8ff2f34f-e6a8-4def-a9b7-a448396391ac/5433099404.pdf
- https://uploads.strikinglycdn.com/files/83468792-33c4-4361-aa1d-2688c319f5d6/13693440116.pdf
- https://uploads.strikinglycdn.com/files/19bf4216-0ce8-49fd-b848-54e266fc0e88/12842115450.pdf
- https://s3.amazonaws.com/gupuso/how_to_be_black_baratunde_thurston.pdf
- https://s3.amazonaws.com/xafaxotaful/evolution_of_periodic_table.pdf
- https://s3.amazonaws.com/wonoti/ayushman_bharat_yojana_list_2019.pdf
- https://s3.amazonaws.com/wopari/tisaxenusujuvoxozifex.pdf
- https://s3.amazonaws.com/sulasatevirexo/lokebimuwavabevito.pdf
- https://s3.amazonaws.com/xurixado/fikomerud.pdf
- https://s3.amazonaws.com/xanebavifamopez/xalibun.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_005_off0001d6b3.bin` `17d299bd01e11026c43e84de9275440e73abe6119a712e6988c1c3b2ef4ea46a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1D6B3	18816 bytes
`font_01_sfnt_off0002124c.bin` `f754faa4a6c87af14a74c44dd9b448838ab9ce7a4fdef8385180bf87e54e89cc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2124C	5052 bytes
`font_02_sfnt_off00022377.bin` `407fed614d7b2e94372f1707d9f6e9818f9b73fd317c2f2f5df81bb2aeca1ca0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x22377	18984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.