Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b9acda91f5c2bb7…

MALICIOUS

PDF

51.4 KB Created: 2020-10-25 07:14:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25
MD5: 170a23982a803877f5221362d3b39a67 SHA-1: 6608c1c8ffc336a6803dd152be0da4657f022bb4 SHA-256: 1b9acda91f5c2bb76c4fe842dea5f27a2639ea370b76503105073c863f608aa6
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=vidisic+gel+bula+pdf In PDF document text
    • https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/gojifopiwugeludaz.pdfIn PDF document text
    • https://juporolo.weebly.com/uploads/1/3/1/3/131380745/ac22e63bab1.pdfIn PDF document text
    • https://bubudatitiga.weebly.com/uploads/1/3/4/3/134308982/acd96c4c960dee.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ad6da42-cf85-4b58-bc2e-ca28521dd97a/90904728722.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1164eeb0-b7fa-4749-aecb-39e68d914f13/33242674696.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a11ca20-9143-4999-a08d-cff7feb985ec/divinity_original_sin_adventurers_weapons_worth_it.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d204a339-16fa-4b6c-b201-25add7c54988/73172396661.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ed92855-8257-4e47-8939-1b520a93fa25/descargar_juegos_para_celular_tactil_uptodown.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55242204-8d31-4309-b2bd-93ae951f1517/98248901104.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58fee668-b490-437b-a8fe-1a31b270e9ed/11556502265.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0788df0a-f460-4361-b797-bedf86910f58/xibujorubo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c6573eb-b1fb-48b3-a973-dded074de8b4/75273992367.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83992b7f-e57c-49e5-acf9-cd0ed49a377a/8613355940.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/8697/7441/files/27233359128.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/7952/3240/files/fibaxisunovamumoleku.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/3374/1480/files/faweni.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/0271/4014/files/live_stream_football_tv_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/0685/2757/files/7715244065.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/7474/0936/files/el_capitan_santa_barbara.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000088f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x88F4 5332 bytes
SHA-256: ec5a3783ec1ef6d7c41e177cb332a77791f875cd98fcd8699fe76129cbdbea11
font_01_sfnt_off00009b2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9B2E 11228 bytes
SHA-256: cb5929f3c7740abe91c18787834aa828ad92c2fc50adc050628d777671d37635

Open this report in the interactive analyzer, or submit your own file for analysis.