Malicious PDF — malware analysis report

Static analysis result for SHA-256 0df8e638bca400d3…

MALICIOUS

PDF

44.3 KB Created: 2020-10-02 08:00:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 16e5023b1b5d8551376c76f859a0844e SHA-1: b17b53d97874b2ac546725096f60e33f9bf456ae SHA-256: 0df8e638bca400d31ade9e72fdb3d4408ed2a65f20ce64bb02f83bebf4505a1f
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=2013+honda+accord+user+manual In PDF document text
    • http://podojifad.vertexprofessionalpainting.com/uploads/1/3/0/7/130739655/7370091.pdfIn PDF document text
    • http://files.ataofallonmembers.com/uploads/1/3/2/6/132695200/8837149.pdfIn PDF document text
    • http://files.getset2digitise.co.nz/uploads/1/3/1/8/131871864/3722c0.pdfIn PDF document text
    • http://files.sissysboutiquehtx.com/uploads/1/3/1/4/131406049/wudefixo.pdfIn PDF document text
    • https://site-1038715.mozfiles.com/files/1038715/74356522543.pdfIn PDF document text
    • https://site-1037196.mozfiles.com/files/1037196/72145057110.pdfIn PDF document text
    • https://site-1036627.mozfiles.com/files/1036627/pesokemufalovitosinat.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/27462f1d-6445-422a-a90a-08b13614c286/81825823442.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5183d2b0-903d-41bf-b6a0-db1cb4926058/wimikofivulalezubizepa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c1fb101-79bd-4ec0-82bc-a5ff744457e6/bakaduzovovofub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f67810e-7a3e-44ab-9e04-f2da569e91f4/39796099508.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94134062-1496-4334-bdff-e4d6e65de75b/zafedodiwik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1196e3cf-05a4-4b95-a984-c0c19283c3a7/vomosiwilutejodebu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c41417a-f1ec-4c74-8705-2186ffef54e6/54910451321.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006ee9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EE9 5572 bytes
SHA-256: 7759170624ad3ea229470b8485d757ccb704fd7daa75692b7e37a9551b5c6df9
font_01_sfnt_off000081aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x81AA 10288 bytes
SHA-256: 5110cf203a323d59f63f70d73727a588352db9604b3f4fe6c5af657c605eaeb9

Open this report in the interactive analyzer, or submit your own file for analysis.