PDF malware analysis — malicious · 13b0077f1251683d

MALICIOUS

PDF

42.5 KB Created: 2020-10-29 02:35:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23

MD5: bf05cad73804930a4c89bda35cccce0d SHA-1: 03b6d7148bd0f71b0b243a827c58498be7ba84a3 SHA-256: 13b0077f1251683dc0f4db8b583c7d266525fe35c8cb5d1b2fb47e0b61994932

184 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=mini+cooper+s+owners+manual+2007 In PDF document text
- https://cdn-cms.f-static.net/uploads/4367921/normal_5f90b8a9383b7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367624/normal_5f87697170ad4.pdfIn PDF document text
- https://lujadogube.weebly.com/uploads/1/3/4/5/134522393/3277851.pdfIn PDF document text
- https://goneludolazoga.weebly.com/uploads/1/3/4/4/134488647/2334efede5ff4d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427267/normal_5f9853cec952e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4376849/normal_5f8eebb9c6dd7.pdfIn PDF document text
- https://xudaxeja.weebly.com/uploads/1/3/4/3/134339900/zitepopaga.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367680/normal_5f885806038e9.pdfIn PDF document text
- https://guburumo.weebly.com/uploads/1/3/4/3/134322172/doxovuvibajiwinep.pdfIn PDF document text
- https://zikavudosun.weebly.com/uploads/1/3/4/3/134329779/dimuwitidim.pdfIn PDF document text
- https://kadeborejegan.weebly.com/uploads/1/3/2/7/132740978/52afa65.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366620/normal_5f8b74cf10cb0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4412379/normal_5f99d1e07d4ca.pdfIn PDF document text
- https://vavavutexe.weebly.com/uploads/1/3/4/4/134441002/siwefukes.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384644/normal_5f984704645b7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/51e49fb2-064e-4280-bc96-539b36cca1f7/wovunesebazapuxerinilebul.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f43e1792-6cac-4b00-87bd-32c83f318728/51283442854.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbd752cd-c9f8-49a4-8c98-6bf969881ee1/37663501809.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/27b3e04d-60fc-4b7c-bcee-0d28ebd46605/59158838173.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b854eb6-680d-42c8-9fe9-7d92a3b1e3cd/bewobakikotulufoxufav.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b720f27-fac5-44b2-8d33-442f5ca2843f/organigrama_del_departamento_de_ama_de_llaves.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/435c50fb-0137-4157-8e5a-bb357f137eec/levuzizogoxuvabi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005794.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5794	5332 bytes
SHA-256: `0c667cd4bdfcb75be9d3d7e5b3da735f4253457a104a107057c1f15244da1d7e`
`font_01_sfnt_off000069a4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69A4	11292 bytes
SHA-256: `95c0e49ccebdbf53f2af9f070e627ef9868a8b411735badb68f5a86fb5a060a9`
`font_02_sfnt_off00008e95.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8E95	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.