PDF malware analysis — malicious · f09b22ed82132f25

MALICIOUS

PDF

42.0 KB Created: 2020-08-30 06:48:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 13c59394a32916ffe43fea024323c4b9 SHA-1: 0d627f8e63db4aafaf7d8b0802fec2e6a40e0754 SHA-256: f09b22ed82132f252d03ee1fa5a8e7ccd07af33a319c134a7d02951a5736447d

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF contains a link to a known malicious redirector, ttraff.com, which is likely used to deliver a payload. The document body, though heavily obfuscated, contains references to 'Rise of the reds 1.87 download' and the malicious URL, suggesting a lure for downloading potentially unwanted or malicious software. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/wix?keyword=rise+of+the+reds+1.87+download
- https://static.usrfiles.com/ugd/599026_a7035a06f1c54324ad4babc18e6bab88.pdf
- https://static.usrfiles.com/ugd/eb4c03_911750486f414508a652c85d2fb7f2ad.pdf
- https://static.usrfiles.com/ugd/b8c837_f2ffacc0c6ff43fcb6dbbfa815e2754a.pdf
- https://static.usrfiles.com/ugd/0c4177_d14cc5d6ea564f2f888886ac53a39465.pdf
- https://static.usrfiles.com/ugd/b8c837_f38a12d1c70e47da99495fcc8a953bd6.pdf
- https://static.usrfiles.com/ugd/33ab24_8075a1ce3e1b407080f84855207c96cf.pdf
- https://cdn.shopify.com/s/files/1/0431/9825/1165/files/tizajesig.pdf
- https://cdn.shopify.com/s/files/1/0431/7514/9719/files/2180262564.pdf
- https://cdn.shopify.com/s/files/1/0436/9511/2347/files/job_advertisement_examples.pdf
- https://cdn.shopify.com/s/files/1/0432/2272/8866/files/5773212659.pdf
- https://cdn.shopify.com/s/files/1/0430/9545/7941/files/79796905583.pdf
- https://cdn.shopify.com/s/files/1/0429/9168/1699/files/67648676597.pdf
- https://cdn.shopify.com/s/files/1/0428/1715/9335/files/wederumejum.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000065ba.bin` `2521bd37bcaf847f1dea8a2388d1f126478793dcceeb4c8311d391c6b686dc8e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x65BA	5452 bytes
`font_01_sfnt_off0000785e.bin` `3372e3f3134b01a771500c1fcabb7fa0e3522cfc7a354b5baad60bcb2bc4f700`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x785E	10280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.