PDF malware analysis — malicious · e552de00326644d6

MALICIOUS

PDF

78.6 KB Created: 2020-12-22 02:04:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 3e7ecb3d948bb3116df872c12cfeff0e SHA-1: e7e6fdc0fcac537470e7535c24b4d81d33542f2d SHA-256: e552de00326644d6bee890343df56cb9b4103548504359877460031b44d4aa06

254 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of embedded links, many of which point to redirector infrastructure. The primary redirector URL, https://traffmen.ru/strik?utm_term=wyze+cam+pan+apple+homekit, is flagged as malicious and likely serves as a lure for phishing or malware distribution. The heuristic firings indicate this is a malicious redirector and part of a link farm, suggesting a campaign to drive traffic to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/strik?utm_term=wyze+cam+pan+apple+homekit In PDF document text
- https://gosedizomomusuw.weebly.com/uploads/1/3/4/3/134313056/ximitujewarib.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502906/normal_5fad55e62319d.pdfIn PDF document text
- https://zefipomez.weebly.com/uploads/1/3/4/8/134882075/navegubevezinafufiso.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/difigomisosak/tonifekexejuse.pdfIn PDF document text
- https://s3.amazonaws.com/lofese/vonepevaresaji.pdfIn PDF document text
- https://s3.amazonaws.com/ruzaganog/tujineruj.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf67f1af5bf52c326c0eb/1606219393690/76799942186.pdfIn PDF document text
- https://static1.squarespace.com/static/5fdf4ccac2d4633280f4eeba/t/5fdf8070f23a830a59c15473/1608482928874/crossword_clues_and_answers_app.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc65d1d1c8c741314573aa3/t/5fd6ac35ab1a676c729a1e1b/1607904309935/rovebikumofo.pdfIn PDF document text
- https://static1.squarespace.com/static/5fdfd92f5b7bc96605610b65/t/5fe0f0ae2718ad77b4fa2a97/1608577201028/61879420660.pdfIn PDF document text
- https://s3.amazonaws.com/wutisigila/63402591814.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc0c273a13a450babf34cb7/t/5fc14524145a8629dcdf88e8/1606501669434/astronomy_study_guide_quizlet.pdfIn PDF document text
- https://s3.amazonaws.com/xijuxosisomuna/gonutemirax.pdfIn PDF document text
- https://s3.amazonaws.com/sedimeraxufi/pusejalituf.pdfIn PDF document text
- https://static1.squarespace.com/static/5fc27fb3239b0722913b63ef/t/5fd1f8c1a9eaf43bd858eb9a/1607596225740/51471608241.pdfIn PDF document text
- https://s3.amazonaws.com/jeromopelurab/sutujemonaduburutuxi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e719.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE719	5128 bytes
SHA-256: `3cfd5411d9734419515130b53fb974a8aba4eaf9df5728195c0bb383cc8debe4`
`font_01_sfnt_off0000f87a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF87A	5716 bytes
SHA-256: `9c2c50b0207a91318890433c8f8737042548583d41f8090350ed0d646f3e8c22`
`font_02_sfnt_off00010872.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10872	10708 bytes
SHA-256: `68d37e0f076d66089497569b08fc6cfb8f92bea58569def30700f7b5d131c18f`

Open this report in the interactive analyzer, or submit your own file for analysis.