Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a16524d2e66db44…

MALICIOUS

PDF

43.1 KB Created: 2020-10-15 18:21:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 082c2f1e8b54322f3a724d3921576f09 SHA-1: 6c9ad4cc4df4e871b2d736dcb7dddd6cd6259e7f SHA-256: 0a16524d2e66db44d5ab92cb26c12653c2c45d9eee5e7188d628ebb1b014a4e0
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=ejemplo+marco+contextual+de+una+tesis+pdf In PDF document text
    • https://bijifejutumaxob.weebly.com/uploads/1/3/1/3/131381781/08d42.pdfIn PDF document text
    • https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/metor.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/3718456.pdfIn PDF document text
    • https://site-1043978.mozfiles.com/files/1043978/5432233349.pdfIn PDF document text
    • https://site-1040503.mozfiles.com/files/1040503/76558817667.pdfIn PDF document text
    • https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/visavikawitavu.pdfIn PDF document text
    • https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/d8065cd0ebc23d.pdfIn PDF document text
    • https://riwisasivituw.weebly.com/uploads/1/3/1/0/131070703/jekowis_fuvonobux.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/3625/3601/files/xamiloz.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/0911/6840/files/anatomy_and_physiology_lab_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0464/6027/2808/files/lifekewurega.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/1464/4127/files/49100405420.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a0b1002-3fd6-4dc6-abd5-8e18d95ae4f0/bufekofa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67aad041-9621-4183-84fe-6c6c19143932/7284147641.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/946e3839-db59-4b34-8d8a-bc56400e380d/ruxoresozegajexonemijip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/317b0116-5a15-4fdf-8665-9e8bd2b48569/budiresato.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38848506-4a39-4586-92e3-d7c5640d12ea/gexuduzujavoferukofitot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b5ea5db-46e5-4cb7-ae25-077a6618d3a1/korevodamu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7420689d-3b92-4214-99fd-298a02b4c191/jipelusa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/089b2877-3d72-4ced-af97-a663a0ca5a84/tojotonirefu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000676a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x676A 5400 bytes
SHA-256: 458da1bb2d25cc74ff9d36df7de086958cf7463144f9a4fe7b84c53ae8eb44f8
font_01_sfnt_off000079b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79B7 10896 bytes
SHA-256: dfddfda3c7046b01e52e60efb3f5b350f2ac86d5b40dba633fd3afb79870f20e

Open this report in the interactive analyzer, or submit your own file for analysis.