Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f235ad1bcc49c05…

MALICIOUS

PDF

46.8 KB Created: 2020-10-29 01:42:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-03-01
MD5: a65e683b9067d3ba5b7be609e69c799f SHA-1: 9560803d86d7f780ff718f8e21639d542cf734a8 SHA-256: 2f235ad1bcc49c055b19f3893b8f72db1040902fee6c8a31739e6f614673b8b2
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=chapter+2+study+guide In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369802/normal_5f8a7c8dabc50.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385197/normal_5f91751dd96f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401558/normal_5f98c5a999a8b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/03ad2a8a-5afa-4b94-9f71-668b171ea95e/2516490892.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d8e0e82-fe76-41c2-9367-c55546a63d94/sunukarokerali.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/sobagekobebuwuti.pdfIn PDF document text
    • https://s3.amazonaws.com/jamokaroxoj/xitagep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4419b50b-1e78-4786-b0fc-d3043e9817d7/how_to_embed_a_in_squarespace.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3e8b18c-0030-4e5f-9af0-1cd890f5b4f6/55201559628.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/380eba8b-89aa-4e99-9c93-0c07b87363df/63736021028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/883dbf52-6b82-4abe-b7db-2f10324a8a07/19391209661.pdfIn PDF document text
    • https://s3.amazonaws.com/wavunot/gerd_ldemann.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d3df3b9-11c8-4f85-8a9c-2f2fefee159e/20491180020.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/psychological_testing_and_assessment_kaplan_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e8c3e8d-c133-46d6-943d-d9ed3f908ad3/gidunidifupazobokobep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5084a6d0-2c9a-4a97-83bf-595a0a5d0b2a/92670850164.pdfIn PDF document text
    • https://s3.amazonaws.com/mijedusovineti/normas_de_auditoria_interna_imai.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20c67e85-fe04-423c-9e03-d61c1bd6773f/welimejiborex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90ebc7fb-b522-4c89-ba45-dce8c7f0352b/peter_carroll_chaos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce20865a-b1c6-4b57-803c-dbdabdf21035/by_the_great_horn_spoon_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48c21a07-188a-4962-acfc-c0e492536bef/zaritupesiwapevojavotex.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/vudoxag.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6952 5112 bytes
SHA-256: 776b78a6a2049d863d9791a52c757b6988132bbe79ff255bb68407a8addbee98
font_01_sfnt_off00007ad2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AD2 11132 bytes
SHA-256: 4be681e4fa4a37f608f270f04a7db07740ea58fb318b956aed27306dfa0d486d
font_02_sfnt_off00009fdb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9FDB 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.