Malicious PDF — malware analysis report

Static analysis result for SHA-256 131807089be7643e…

MALICIOUS

PDF

34.4 KB Created: 2020-10-19 01:46:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 332859a94c19810f4881d9e6ea6aadc4 SHA-1: fdbb02a71004d5c5cc776815913ab1ee1b3a1edb SHA-256: 131807089be7643ebb99aff398b65ed240a42d6d5036c2fee9166f0fbdfd0a39
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=yeoman+county+stove+manual In PDF document text
    • https://tumixivig.weebly.com/uploads/1/3/1/6/131636813/9ad99.pdfIn PDF document text
    • https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/36b6bdc420bff0d.pdfIn PDF document text
    • https://kuvofexe.weebly.com/uploads/1/3/1/1/131163751/mokidujo-kixojovi-zuxapaniwe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368492/normal_5f8b71105583a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384461/normal_5f8cb13d745df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371010/normal_5f893f0501455.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371788/normal_5f8962eba3252.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369304/normal_5f8ca74a28697.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369927/normal_5f882ab8c5ad4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/94020fb8-871b-46b3-a8b4-194d9d6ec551/14131448898.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a32205f9-bbb8-4565-94cc-54bfe6f12f48/53263575042.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3606012-ace9-433d-ad55-e4a32bc82521/43535353443.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/9514/9730/files/24_hour_fitness_super_sport_millbrae_reviews.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/7756/7132/files/alarm_clock_in_android_example.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0463/0321/5778/files/16234740487.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/9191/3624/files/nadomajavorifukumop.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/5269/3669/files/chapter_5_review_the_periodic_law_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdad2caa-6f97-47d2-8945-7eced301b503/febovujafolonewe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/192a1982-eb56-4793-b4dd-04aa928f5549/93436731342.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac7a10ee-d7ef-4f06-9f1e-ba3a01f82d22/wowajufasopireropikevimi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e94cb073-e5db-406b-9105-32c5724bdd54/movupigojiwidowuposodijax.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B4C 4972 bytes
SHA-256: bd1ec6c7ccf28056895c13731001a8bc46eb971508c6bcef1dd869ec01ac9bc3
font_01_sfnt_off00005c30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C30 9512 bytes
SHA-256: 544b9aed9c2a1d8fe294ac20ed9ee825368ede388070e8b8a53a0c57a75aa43c

Open this report in the interactive analyzer, or submit your own file for analysis.