PDF malware analysis — malicious · 23efeba36f598706

MALICIOUS

PDF

35.5 KB Created: 2020-11-06 14:21:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2022-06-20

MD5: 9c9ce7b984d542598ac44215f0467a65 SHA-1: d9830ff42ae07d0a602b932e5c95e2ece3dd93c7 SHA-256: 23efeba36f5987064ca17055871a6d71e541e402e75dad0ede8f2eb036a02709

76 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?keyword=jupiter+worksheet+pdf PDF link annotation
- https://purusoze.weebly.com/uploads/1/3/4/4/134495244/xusewigenani_ziror.pdfIn PDF document text
- https://sabidodavo.weebly.com/uploads/1/3/1/4/131408103/setozaxozifirofan.pdfIn PDF document text
- https://razemifutibedur.weebly.com/uploads/1/3/4/4/134431978/8872439.pdfIn PDF document text
- https://pojutawetuje.weebly.com/uploads/1/3/1/3/131382470/xerasiduvaripaboken.pdfIn PDF document text
- https://wubigunes.weebly.com/uploads/1/3/4/5/134507070/gumonun-gazasen.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/luxelula/bloons_tower_defense_2_hacked_unblocked.pdfIn PDF document text
- https://s3.amazonaws.com/mibiwivanetuj/43727502356.pdfIn PDF document text
- https://s3.amazonaws.com/webipejonavuv/sims_4_potion_of_youth_does_not_work.pdfIn PDF document text
- https://s3.amazonaws.com/nitajosasa/kegekuxibumok.pdfIn PDF document text
- https://s3.amazonaws.com/petikamov/all_american_institute_of_medical_sciences_aiims_jamaica.pdfIn PDF document text
- https://s3.amazonaws.com/vonuxagupeduze/kenny_smith_divorce.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004c87.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4C87	5032 bytes
SHA-256: `661e890d000f5ae8af46af9e7e07f4f7ce5d17902f9c3b4913931eab1e049770`
`font_01_sfnt_off00005db9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5DB9	10516 bytes
SHA-256: `2bbf4975e38d0c839428025ba7d3e66026f52fbe3763330cbdaebf4acf8a0c1a`

Open this report in the interactive analyzer, or submit your own file for analysis.