PDF malware analysis — malicious · 2f1744a3255b63f2

MALICIOUS

PDF

37.2 KB Created: 2020-10-01 13:12:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15

MD5: 51d0e84bacff0d0a443822ee9c9e29e9 SHA-1: 6a4dd7cecaad14c84babee3e3d662fbc2a1ed47d SHA-256: 2f1744a3255b63f2770c98c74b44637f5bb2541bb5c083055e160bd7cd253b60

124 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/strik?keyword=bayesian+inference+in+statistical+analysis+box+pdf In PDF document text
- http://files.technologytransferinnovation.com/uploads/1/3/1/8/131872238/90d0dcd0.pdfIn PDF document text
- http://rofipaj.muevetefacil.com/uploads/1/3/1/1/131164250/porazevebutod-lutuvafu-xopajazeruduto.pdfIn PDF document text
- http://files.geoffwestlake.com/uploads/1/3/0/7/130775952/danefip.pdfIn PDF document text
- http://files.assistancedogassociation.org/uploads/1/3/0/7/130775052/tesizepalorumubat.pdfIn PDF document text
- https://site-1038586.mozfiles.com/files/1038586/pevik.pdfIn PDF document text
- https://site-1036713.mozfiles.com/files/1036713/31953277297.pdfIn PDF document text
- https://site-1038592.mozfiles.com/files/1038592/73912486134.pdfIn PDF document text
- https://site-1037261.mozfiles.com/files/1037261/3522139794.pdfIn PDF document text
- https://site-1036925.mozfiles.com/files/1036925/zigefinitubulefugow.pdfIn PDF document text
- https://site-1036955.mozfiles.com/files/1036955/8111525705.pdfIn PDF document text
- https://site-1039837.mozfiles.com/files/1039837/99131183974.pdfIn PDF document text
- https://site-1038770.mozfiles.com/files/1038770/85494963384.pdfIn PDF document text
- https://site-1038796.mozfiles.com/files/1038796/ripunirokuralifozenak.pdfIn PDF document text
- https://site-1037059.mozfiles.com/files/1037059/nukivusekoxufuxelimavapud.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3048a0c4-3ee4-47f1-a30b-7f1def83c40a/35353286823.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f00a122d-3c89-43e1-8e9d-c019cebbc6b4/22789615665.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aab41ee3-fabb-440e-b88c-986daaa72fdf/42428238098.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000526b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x526B	5508 bytes
SHA-256: `5e5b67da8f8de552f08382dae8681a9bc4683910b474456f3393314cfd1aa230`
`font_01_sfnt_off0000653d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x653D	10136 bytes
SHA-256: `f877df5ea8f35099eb6ee8d1dfb32e6f3c5faed7c59bc5696888eaa8f273ad5d`

Open this report in the interactive analyzer, or submit your own file for analysis.