PDF malware analysis — malicious · ef3de89d2049f071

MALICIOUS

PDF

43.6 KB Created: 2020-08-31 07:01:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 325aae9df99e75015dd12d01e80ed54e SHA-1: d159a0f9fa41c54bcfa25f55151642f0a6beff60 SHA-256: ef3de89d2049f071a9e579fbd3b2ec06765b78174cef748d8afa2a2e74796ed8

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 Malicious Link T1059.001 PowerShell

The PDF contains a large number of embedded links, with one identified as a known malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains the malicious URL and references to other PDFs, suggesting a link farm or redirection scheme designed to lure users to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/wix?keyword=nocturne+adam+rapp+pdf
- https://cdn.shopify.com/s/files/1/0433/6222/2232/files/11032589802.pdf
- https://cdn.shopify.com/s/files/1/0433/0687/7080/files/8357326041.pdf
- https://cdn.shopify.com/s/files/1/0439/1400/2587/files/6510335291.pdf
- https://cdn.shopify.com/s/files/1/0434/7245/3797/files/17785553754.pdf
- https://cdn.shopify.com/s/files/1/0434/1678/0951/files/86431489596.pdf
- https://static.usrfiles.com/ugd/b5aed9_c8045826923c4368991fc18fdb839308.pdf
- https://static.usrfiles.com/ugd/10e3af_90a6fbac74cb4ae5b73f38191de5a0ea.pdf
- https://static.usrfiles.com/ugd/b8c837_7d047baad8b8452b82b0280e8bf11a21.pdf
- https://static.usrfiles.com/ugd/b8c837_76409856b9294693a9f06cf6e0a0edd5.pdf
- https://static.usrfiles.com/ugd/f967ac_9812b283f38b4856a3d971e7221da33d.pdf
- https://static.usrfiles.com/ugd/b8c837_6a08c401915e4bd18991ef63afac1668.pdf
- https://static.usrfiles.com/ugd/b8c837_9e4e2a1d621446939847d2da4ef603dc.pdf
- https://static.usrfiles.com/ugd/b8c837_b8c3f96b8e13470b834a4425a36cae95.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006daf.bin` `f5c016856e32d81622ae84a71a3ebed514e4378d7ef62168382f047c2f7993d6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6DAF	5060 bytes
`font_01_sfnt_off00007ece.bin` `fb62a0a71f65f597c25085bfd174774a989caf994ccf6a2a179f8fa73987a118`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7ECE	10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.