Malicious PDF — malware analysis report

Static analysis result for SHA-256 24d002476e2884e7…

MALICIOUS

PDF

45.1 KB Created: 2020-09-17 14:25:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: f9d377c599c0e32a12439965df0ab482 SHA-1: fa0ca2a8447f2f2330bf11780f906d00978cbb34 SHA-256: 24d002476e2884e7e2d2e25f1c1a7b77eca11c6c2ba2bf84dc57bb4461c0d058
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/pify?keyword=double+swag+shower+curtain+with+valance In PDF document text
    • http://teruw.trinitywinchestertn.org/uploads/1/3/0/7/130740292/zakekel-pamojaj-pitanexexojupa-tafuzubapafolew.pdfIn PDF document text
    • http://buzoxete.livinge.co.uk/uploads/1/3/1/0/131071145/kivapise_zazarivunur_vivupopegodusu_gizegupivubepa.pdfIn PDF document text
    • http://peted.takebacktheknight.com/uploads/1/3/0/8/130873880/8183618.pdfIn PDF document text
    • http://kugusibam.hammerartgallery.com/uploads/1/3/0/8/130814729/230579.pdfIn PDF document text
    • http://files.artsindustryalliance.com/uploads/1/3/0/7/130775974/kunemotipuv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://204511fe-a0a6-4895-87bc-fecac455aa74.filesusr.com/ugd/c6ac46_39c3f03a3b5f4ac6a13b4a8b8935f345.pdf?index=trueIn PDF document text
    • https://c521ed7c-34c7-4c56-b7c3-45f7ef4f239f.filesusr.com/ugd/0251f0_a419b8136e6f498e877eb109c37cdbad.pdf?index=trueIn PDF document text
    • https://1b4fdbc7-ccd1-4b15-a351-8529c7291e69.filesusr.com/ugd/3ddeef_cc7db792b1f64503869af217406a3dbe.pdf?index=trueIn PDF document text
    • https://7b8e2cb3-0f8e-45e6-9b50-031323bf668a.filesusr.com/ugd/3cb679_4defd9480bd7476b84aa9c3aca6c8d0b.pdf?index=trueIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/1928/4892/files/98554911136.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/5887/8872/files/time_sheets_l_g.pdfIn PDF document text
    • https://c8064145-845c-49f0-9111-b76d651e0db9.filesusr.com/ugd/a9e086_8ddab71b71c441d49732691bb059bffd.pdf?index=trueIn PDF document text
    • https://4c8afef8-115c-4061-a1ee-acbdc9691f7c.filesusr.com/ugd/d13e1f_2028c208ee64423caf244dee5d727e7f.pdf?index=trueIn PDF document text
    • https://1269af23-229a-4bc3-9372-c6efc8c8bce4.filesusr.com/ugd/12daa7_4a88ca1f5f6d41849b4a076b6cd59d4c.pdf?index=trueIn PDF document text
    • https://e771b075-4e9e-45cd-81a7-f8c842da94f7.filesusr.com/ugd/ff2e72_b2acf9e4c75140fdbebcb2c301587d3e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58BF 5352 bytes
SHA-256: 5f1549b26e1494ab01dc4bae67369cf95b7920ec4555696eec5f411f19ef9605
font_01_sfnt_off00006b0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B0E 11012 bytes
SHA-256: 951e22d91c580bffcb7339717f6929e70839ae6a5d9739b174fd9101024a5bd6
font_02_sfnt_off00009062.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9062 16168 bytes
SHA-256: 794d8cc090a449e0d460036171b2d5b2c749cb0dc3f17972c44626ada68ee3d8

Open this report in the interactive analyzer, or submit your own file for analysis.