PDF malware analysis — malicious · e9b8f0a63bf9e18e

MALICIOUS

PDF

57.1 KB Created: 2020-10-25 10:08:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: 053b510ad0ef74e24fae6a84d08c5dfd SHA-1: fef8163d82f981199ddacbbec1c17e2a89480869 SHA-256: e9b8f0a63bf9e18edd0ab73e0a748fd5f4d28f09c6b4006c1b1076c5506d2a94

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm and a critical heuristic firing for a malicious redirector. The document body, though heavily obfuscated, contains the URL https://ttraff.com/123?keyword=microcontroller+8051+programming+pdf+download, which is flagged as malicious. This suggests the document is designed to trick users into downloading files from potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/123?keyword=microcontroller+8051+programming+pdf+download In PDF document text
- https://cdn-cms.f-static.net/uploads/4376359/normal_5f93c070847ec.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f87239a996a2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368748/normal_5f8c50ded7077.pdfIn PDF document text
- https://vodipewelo.weebly.com/uploads/1/3/1/6/131637384/8280916.pdfIn PDF document text
- https://xilorufanil.weebly.com/uploads/1/3/0/7/130739938/rujazokedev.pdfIn PDF document text
- https://folanejo.weebly.com/uploads/1/3/0/7/130776558/molojikipe_gapan_jutorowatuba.pdfIn PDF document text
- https://sujajikozodes.weebly.com/uploads/1/3/1/3/131384638/vonufem.pdfIn PDF document text
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/vevenen-xasunedovati.pdfIn PDF document text
- https://dejolezeg.weebly.com/uploads/1/3/2/8/132815968/330649.pdfIn PDF document text
- https://fisolaxarod.weebly.com/uploads/1/3/4/4/134471724/7435734.pdfIn PDF document text
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/a61639a9d.pdfIn PDF document text
- https://gemaxudemaxepeb.weebly.com/uploads/1/3/1/0/131070646/464961.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/nitirew/hawke_cable_glands_catalogue.pdfIn PDF document text
- https://s3.amazonaws.com/vavapekadoliti/17432535148.pdfIn PDF document text
- https://s3.amazonaws.com/mejados/full_detail_of_gst.pdfIn PDF document text
- https://s3.amazonaws.com/wilugugo/pastel_accounting_for_dummies_free_download.pdfIn PDF document text
- https://s3.amazonaws.com/votawawo/pmt_biology_notes_in_hindi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c784717a-bef8-4c89-a248-b6878270424a/gepesuxukazovopeporine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/321eec26-3295-41fe-a197-f1daf131b991/10504455051.pdfIn PDF document text
- https://s3.amazonaws.com/warapagefasovi/bach_flower_remedies_in_hindi.pdfIn PDF document text
- https://s3.amazonaws.com/zetare/iata_airline_cabin_crew_training_course_textbook.pdfIn PDF document text
- https://s3.amazonaws.com/zerejibixupav/49663447107.pdfIn PDF document text
- https://s3.amazonaws.com/guxosa/aprender_juntos_portugues_1_ano.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files2/how_to_calculate_cable_size_for_motor.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000078ee.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78EE	3048 bytes
SHA-256: `93d909c15f8fe31848280e03c47e230d0324290fc6b6f584dfa23813b0811f14`
`font_01_sfnt_off000083c7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x83C7	5908 bytes
SHA-256: `2384f3a1204e7185ea11c227b63f964e336ceda47a36d28f3f07917c7dd36bef`
`font_02_sfnt_off000097f4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x97F4	13072 bytes
SHA-256: `55fd7717ce204c44118f37056c210a0a11f90d72bb3477b6251272bd2af7cbce`
`font_03_sfnt_off0000c17c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC17C	16028 bytes
SHA-256: `0bae8649ba252bcfab81cb8324cfe1737d73e47191b507e117e6d0858e0066a8`

Open this report in the interactive analyzer, or submit your own file for analysis.