PDF malware analysis — malicious · e5dd413f7f852fcd

MALICIOUS

PDF

89.4 KB Created: 2020-09-04 21:42:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f0c3943b685687c5968a6fee57324d6e SHA-1: ae9aeecfbff11c32cda7f4dbe4db64763ba69a65 SHA-256: e5dd413f7f852fcdb25ee91e8ee331b6f246a1e330b8110ab0479997ccc0a833

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains embedded links, one of which, https://ttraff.cc/wix?keyword=spring+boot+jdbctemplate+stored+procedure+example, is flagged as a known malicious redirector. The document body, though heavily obfuscated, contains references to this URL and appears to be a lure. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=spring+boot+jdbctemplate+stored+procedure+example
- https://cdn.shopify.com/s/files/1/0449/7879/8750/files/operadores_mecanicos.pdf
- https://cdn.shopify.com/s/files/1/0432/7538/7043/files/wapking_movies_tiger_zinda_hai.pdf
- https://cdn.shopify.com/s/files/1/0435/3084/6363/files/a4_size_in_pixels.pdf
- https://cdn.shopify.com/s/files/1/0430/8225/2442/files/nirakuwutafefiv.pdf
- https://static.usrfiles.com/ugd/787b0a_cfc3e52b593d4c51a56b53a7f4ff614f.pdf
- https://static.usrfiles.com/ugd/2d797c_1a839a02c8c04498978af49ab624ced7.pdf
- https://cdn.shopify.com/s/files/1/0431/8029/4298/files/52554963393.pdf
- https://cdn.shopify.com/s/files/1/0440/2806/7990/files/definition_of_alternative_dispute_resolution.pdf
- https://cdn.shopify.com/s/files/1/0435/9123/7791/files/chaucer_the_nun_s_priest_s_tale.pdf
- https://static.usrfiles.com/ugd/270e53_804b90fcc4bb4b7e82a7d1ef5aec33c4.pdf
- https://static.usrfiles.com/ugd/b8c837_76881a6c76af480785f015fecb06af56.pdf
- https://static.usrfiles.com/ugd/724bd4_a22ea72d3a72408db899f226ca6eb331.pdf
- https://static.usrfiles.com/ugd/c81504_71138d5f9ee2476cae508b3ecd6e7e0f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00011e3f.bin` `b175634dfe2158ab76bad04c17583d1f93b50bcbae73a5f5fa295984f7bb2672`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11E3F	5780 bytes
`font_01_sfnt_off000131db.bin` `e8414bcc32d59f4eef83984904a8b776836bc7df9f3ebf1b14398e85c0726327`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x131DB	11360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.