PDF malware analysis — malicious · ddffddc9c391af08

MALICIOUS

PDF

40.0 KB Created: 2020-08-31 08:40:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: faac2b9a586b13d26bbd4ddf752d69a1 SHA-1: 6fcd3946f8d75d5df9359242704957a9bd2cd99e SHA-256: ddffddc9c391af081ee6205de7240e11f412e3afb5e5e3b2a7b018b71e2a0b77

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, with one identified as a known malicious redirector. The ML classifier strongly flagged this PDF as malicious. The primary malicious indicator is the embedded URL that leads to a redirector, likely intended to host further malicious content or phishing pages. The document body contains garbled text but also includes the malicious URL and several benign-looking PDF links.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=thelonious+monk+misterioso+sheet+mus
- https://static.usrfiles.com/ugd/b8c837_7f19fccfaa3946ce9e5e591fb39577f8.pdf
- https://static.usrfiles.com/ugd/b8c837_c2dc3b7792394de795b22d48e32dcdb1.pdf
- https://static.usrfiles.com/ugd/b8c837_23b0a355ec0c4471adac9bbe405ca074.pdf
- https://cdn.shopify.com/s/files/1/0429/0750/0711/files/95064828385.pdf
- https://cdn.shopify.com/s/files/1/0432/5598/8374/files/83602417129.pdf
- https://cdn.shopify.com/s/files/1/0437/8116/1111/files/82983806933.pdf
- https://cdn.shopify.com/s/files/1/0440/8007/0808/files/critical_analysis_of_hamlet.pdf
- https://static.usrfiles.com/ugd/b8c837_fa95854cc88841c696f29247252cd6fa.pdf
- https://static.usrfiles.com/ugd/455f95_f1b8be5ba7794abcbd190b3a7b14d987.pdf
- https://static.usrfiles.com/ugd/89064d_e76b59e80b974503899925b521cc9910.pdf
- https://static.usrfiles.com/ugd/5d2cf3_5081ec7f1c444ec39372cf7b584c3cd5.pdf
- https://static.usrfiles.com/ugd/c0b427_66b0edd24b99415cbff48d32d660fdac.pdf
- https://static.usrfiles.com/ugd/c0fca2_517d526776534e2982a2b87b3000ea7d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005149.bin` `36fb64c38a4c1a2c970cc22150b1776698205adf14c416b806e45d88d6028fbd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5149	4728 bytes
`font_01_sfnt_off00006127.bin` `b649ec9d77c1747f61f4ebf377c2a8053699461ed88d62f0c667770f679a66a2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6127	15528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.