Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f6756190279160f…

MALICIOUS

PDF

60.7 KB Created: 2020-10-17 23:42:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: d91f6c7c00332c2f67b143bf8b7a5dcf SHA-1: 9516ef57618dce78b1960032001114f2dc288bce SHA-256: 1f6756190279160ff3b08fabbf456a44da73afd8823fedc8602388a5651860f5
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/123?keyword=tokyo+otaku+shopping+guide In PDF document text
    • https://topodomero.weebly.com/uploads/1/3/2/6/132696018/e89fd39b.pdfIn PDF document text
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/9232432.pdfIn PDF document text
    • https://juragubiv.weebly.com/uploads/1/3/0/8/130874328/3cc750bf2c5.pdfIn PDF document text
    • https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/347075.pdfIn PDF document text
    • https://jimigafekalese.weebly.com/uploads/1/3/1/4/131407537/fb6654380.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/1d44b872.pdfIn PDF document text
    • https://wetuxabo.weebly.com/uploads/1/3/0/8/130873937/dfd41f0916b69d8.pdfIn PDF document text
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/fesixukorupu.pdfIn PDF document text
    • https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/kipen_rugefegoxuruwi_vexugimajo.pdfIn PDF document text
    • https://zeteparikimifol.weebly.com/uploads/1/3/1/6/131637109/aebbe664bb.pdfIn PDF document text
    • https://gemaxudemaxepeb.weebly.com/uploads/1/3/1/0/131070646/wugipesobikuv-lokupiz-sarelived-lifoleru.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/67d40f59-87e8-4f78-aff9-b71b4f77d8d2/vifufimezabufawades.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e99a4db-ef3e-4431-b87b-57dbecc4de1c/minag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f914122-0163-4893-95ef-1d056bee3e4a/95415219461.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7978feab-c887-4282-ae33-317bf0975877/72351164547.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/613e3daa-076c-452b-b004-69c5573e8245/80022003760.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3af7dc0-f59b-481e-a3b3-63caee7a41e5/20525811364.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8593155b-56c4-4c1a-893b-666ff6eb374d/vuraguzufizamexo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/743d5609-3bd3-4ee0-9624-ef6d53703ef2/kufuvupimibibenijejoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/469376a8-0fc2-46b2-b6bc-c4e98a6fd4e1/lytic_and_lysogenic_cycle_of_bacteriophage.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/9105/7568/files/85760838114.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/3460/8284/files/22692496688.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9271/4685/files/wolfgang_puck_steamer_rice_cooker.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/9465/3595/files/9054265951.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/8021/3185/files/99447228882.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008824.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8824 4880 bytes
SHA-256: ca888d60545b53d19f7bf13870fe16dcbfc726ac9201154281dbcb6f1dd1159e
font_01_sfnt_off00009918.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9918 5208 bytes
SHA-256: 31570301490f38cf48d5b724814eb3b53bc21276b2b00ba8bf63e69d279387ac
font_02_sfnt_off0000aad3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAAD3 10804 bytes
SHA-256: 6ab1b88e529cda26e4129a0e9ef75aea9bd9580034f016b3a4340d463820bd82
font_03_sfnt_off0000cee8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCEE8 16252 bytes
SHA-256: 69879309ddd1745df8e092d35e0176ecf474bf0e000287aa188a50b81b44f159

Open this report in the interactive analyzer, or submit your own file for analysis.