Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bff316fec173462…

MALICIOUS

PDF

67.1 KB Created: 2021-03-08 13:15:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-19
MD5: 90d8727f349f96b7cd86a12c5344ae1d SHA-1: db2362a1c5ba65b4a915e487286465c8e139ba77 SHA-256: 1bff316fec1734620b39e801263a3950f0a5b466d4158b3c0a6bab5bcf2e052d
196 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=pdf+to+word+ocr+software+free+download PDF link annotation
    • https://vosovijuz.weebly.com/uploads/1/3/0/8/130813614/gisoxididuki.pdfIn PDF document text
    • https://julovupepopa.weebly.com/uploads/1/3/4/5/134522834/leboborowulix-kusowujosira-zagugekavimipin.pdfIn PDF document text
    • https://vipozuguru.weebly.com/uploads/1/3/1/4/131483083/lululili_jinepuwun_gerupub_lofufivizav.pdfIn PDF document text
    • https://fiziwiminika.weebly.com/uploads/1/3/4/6/134686918/rufivej-vevitowa-vatufazonina.pdfIn PDF document text
    • https://lavivatum.weebly.com/uploads/1/3/1/4/131437335/d241e259da9a08.pdfIn PDF document text
    • https://turonobofudub.weebly.com/uploads/1/3/4/4/134463989/nunoluzopelaf_posutuxor_bifate.pdfIn PDF document text
    • https://mudomuroda.weebly.com/uploads/1/3/4/7/134728654/4010466.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/wallpaper_iphone_free_3g.pdfIn PDF document text
    • https://a21f0d7d-5fe0-4a99-a381-3b18266e0880.filesusr.com/ugd/6c313a_ff8dd5f8a9ac4749a249c49a29551ebf.pdf?index=trueIn PDF document text
    • https://b8f7bc2e-5f90-466c-a76c-b8215bfdb3ae.filesusr.com/ugd/9717d9_5ac17d0ea0304a4491782a7bb4a9eeee.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fazujo/56635228572.pdfIn PDF document text
    • https://s3.amazonaws.com/jimugivos/cotton_bed_sheets_online.pdfIn PDF document text
    • https://9539e3d7-93ad-434a-85ac-22bd9bdb82bb.filesusr.com/ugd/df7b34_eb3c8eefb28f437d98ac55c5bec09edb.pdf?index=trueIn PDF document text
    • https://c1f973cf-d719-4acb-8f9e-cd83ae4fb94d.filesusr.com/ugd/057766_4566ad59370a4b74b6e1d1554501e339.pdf?index=trueIn PDF document text
    • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_176bd56a77114558b644d9252f0faaa0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/32585278-83de-4028-816c-67a49edbeb19/65567614159.pdfIn PDF document text
    • https://79e8b926-cc52-4cef-90ae-68e3990d752e.filesusr.com/ugd/694d5d_987f57cebd154f47ad51def4c86d6939.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jiwotarotavuz/arduino_hm-10_tutorial.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a347197d-b7d7-4add-8211-261da92de4fc/69755746875.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB9B 5108 bytes
SHA-256: dfc18010a611956ea091e6b1af308d51dca19723f93677c0f99ee90c9d30fa4a
font_01_sfnt_off0000dd1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD1E 9960 bytes
SHA-256: 0e2aee265026179201513507b9d37192e1444ca5b524cfef882ab71f2c92dc88

Open this report in the interactive analyzer, or submit your own file for analysis.