PDF malware analysis — malicious · 25ed127d0831171c

MALICIOUS

PDF

72.7 KB Created: 2020-10-16 08:18:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15

MD5: 435f4e1dc7194c75e9fdf07ab8613367 SHA-1: 612ea87e30bc6883bb710aa160ab71ba9acee66d SHA-256: 25ed127d0831171ca9983f92ee95486f765ad8d42f6e619f0a1d3e7ef8934ac8

184 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/123?keyword=symmetric+group+s4+pdf In PDF document text
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/09b03b.pdfIn PDF document text
- https://rewemekekebaz.weebly.com/uploads/1/3/1/4/131406535/474185.pdfIn PDF document text
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/lupemu_lumivexojadojex_bubufudisujexi_logejilobarug.pdfIn PDF document text
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/palaj_xofepevez.pdfIn PDF document text
- https://fusesekomufe.weebly.com/uploads/1/3/1/6/131606177/ninigu-wuwunomebit-bediz-mijeson.pdfIn PDF document text
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/3e75a4e696b2f2d.pdfIn PDF document text
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/cc537b7d.pdfIn PDF document text
- https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/rikupeg.pdfIn PDF document text
- https://xawuwotogot.weebly.com/uploads/1/3/2/6/132695388/pidukixezo_ximalinosefo_tirol_ninefasivakeb.pdfIn PDF document text
- https://jezaxegare.weebly.com/uploads/1/3/1/3/131380636/2f0e95c1e.pdfIn PDF document text
- https://tejigenunonim.weebly.com/uploads/1/3/0/8/130813632/suxelujaxosi.pdfIn PDF document text
- https://xanodupujariris.weebly.com/uploads/1/3/0/9/130969381/vurikuwabufaz.pdfIn PDF document text
- https://popilezofale.weebly.com/uploads/1/3/1/1/131164236/4507959.pdfIn PDF document text
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/busixakowun_zefisuni.pdfIn PDF document text
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/ea3c0857f.pdfIn PDF document text
- https://pagofere.weebly.com/uploads/1/3/1/3/131398194/jiwoxub.pdfIn PDF document text
- https://jumuwubugunitus.weebly.com/uploads/1/3/1/0/131070493/7414141.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366324/normal_5f89027388288.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368479/normal_5f8916c23a97a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f86f821b9e0e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367964/normal_5f887dc17ba3d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/8797/7366/files/52404736773.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/2608/7575/files/simple_electric_circuits.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/9816/7709/files/denumami.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bdb8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBDB8	5528 bytes
SHA-256: `0647f81f5f74cc22782fbdaf7f070b276ac6a1c7e17973f545c77d605ebf75ee`
`font_01_sfnt_off0000d083.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD083	13908 bytes
SHA-256: `270732c41e4c798452051be40380f58cf2333942e7cc51391b9c62ff4b88ebad`
`font_02_sfnt_off0000fd96.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD96	16608 bytes
SHA-256: `2d05b58acd3eba3cf0ae31448bb49b85db1cfeb2ee0064a2a2faef58212c6a30`

Open this report in the interactive analyzer, or submit your own file for analysis.