PDF malware analysis — malicious · df7bec086ef3d1a5

MALICIOUS

PDF

41.5 KB Created: 2020-08-30 14:07:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f9c4d961fbebc64e537d4e29e1920864 SHA-1: cfdc070346dc0402b68ed2adb5020fa27677e7a8 SHA-256: df7bec086ef3d1a58f941658a5fb623637c8670bdb226bebef32100d617f5adc

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL `https://ttraff.com/wix?keyword=minna+no+nihongo+1+pdf` is the primary indicator of malicious intent. The presence of a large number of external PDF links, many hosted on Shopify, suggests a link farm or SEO poisoning tactic to distribute malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=minna+no+nihongo+1+pdf
- https://cdn.shopify.com/s/files/1/0436/0785/1171/files/18055916736.pdf
- https://cdn.shopify.com/s/files/1/0429/5491/6003/files/le_moringa_et_ses_vertus.pdf
- https://cdn.shopify.com/s/files/1/0431/5791/3749/files/ranixutilal.pdf
- https://cdn.shopify.com/s/files/1/0432/8164/5736/files/34035110501.pdf
- https://static.usrfiles.com/ugd/c1108c_0d0ee6815b8b47ab9b4eda5c837869e9.pdf
- https://cdn.shopify.com/s/files/1/0432/0631/2098/files/31296482821.pdf
- https://cdn.shopify.com/s/files/1/0428/7817/3351/files/afrikaner_cattle.pdf
- https://cdn.shopify.com/s/files/1/0430/9807/9399/files/59439964782.pdf
- https://cdn.shopify.com/s/files/1/0429/3420/6631/files/11016995922.pdf
- https://static.usrfiles.com/ugd/b8c837_3716386159e84bb3a521068b19b856cb.pdf
- https://static.usrfiles.com/ugd/271e65_2988cd37ffce4ecd982ebb9dd4ee6921.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005142.bin` `3f3b999d7d77f9315080e545601548dd228d62469b82002942a833f9bdc99749`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5142	6056 bytes
`font_01_sfnt_off0000662f.bin` `de638a391247136b0bb22418f657a8ce2c0c06d5b27f2ea7badba6f53ce62359`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x662F	5052 bytes
`font_02_sfnt_off0000776c.bin` `f16858ae3db09940d50f85b5b8bb443d0bb25d22cade6791b5b7a16d8fcb94e5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x776C	9920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.