PDF malware analysis — malicious · e1181a35e89d8d0c

MALICIOUS

PDF

42.7 KB Created: 2020-11-01 05:36:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 7ace9440bc2bda634234449b44736d6a SHA-1: dc93a40645d13954fc3bc3dc4f9a251c6d27b561 SHA-256: e1181a35e89d8d0c0147e50d2dd09d393990851b74a7daf014f37421fe3e6d41

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=bmw+635csi+for+sale In PDF document text
- https://cdn-cms.f-static.net/uploads/4421939/normal_5f9e12fd4d17e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408004/normal_5f9459a4bd658.pdfIn PDF document text
- https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/titufarojuninu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417675/normal_5f9b7ec8b02e0.pdfIn PDF document text
- https://tudupumodowi.weebly.com/uploads/1/3/1/4/131406798/4281276.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/zurovajij/pathfinder_martial_versatility.pdfIn PDF document text
- https://s3.amazonaws.com/bulolimepol/4247049362.pdfIn PDF document text
- https://s3.amazonaws.com/tabobujimo/discovering_your_heart_with_the_flag_page.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d79f0d34-b2d8-4027-89d7-07d2af7fc085/24918975172.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/7527/2855/files/gaxulirud.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005922.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5922	5212 bytes
SHA-256: `e620599b580b8626cf010af7ce3cf580c06ca3035ebdd3d7a8bb2fa65a5ed094`
`font_01_sfnt_off00006adc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6ADC	11064 bytes
SHA-256: `36d012abb842e3721bc97546f89363d2976de2fc093a653cea5a5a3b9bfa3de0`
`font_02_sfnt_off00009005.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9005	4324 bytes
SHA-256: `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`

Open this report in the interactive analyzer, or submit your own file for analysis.