Malicious PDF — malware analysis report

Static analysis result for SHA-256 309175ca877cbc6a…

MALICIOUS

PDF

41.9 KB Created: 2020-10-28 11:44:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23
MD5: a7788620c9baa02ebc82aa1305033e78 SHA-1: ae86250d04aedae85f56ef3b60a50dc6baf22836 SHA-256: 309175ca877cbc6a53ccb5620633c50c64a443ef5e2e7330fbefee9f5b596750
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=beef+n+bun+delivery In PDF document text
    • https://cdn-cms.f-static.net/uploads/4370073/normal_5f98df10b6ba7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384320/normal_5f900b8435106.pdfIn PDF document text
    • https://kexinebig.weebly.com/uploads/1/3/4/3/134338338/zizekadinu-birekepiz-pifurexuxi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403940/normal_5f92635e16f1a.pdfIn PDF document text
    • https://sepikupi.weebly.com/uploads/1/3/0/7/130738949/068843758a79.pdfIn PDF document text
    • https://sabadefupi.weebly.com/uploads/1/3/4/3/134345863/2b78e0db86f7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379626/normal_5f92cf887403e.pdfIn PDF document text
    • https://dejolezeg.weebly.com/uploads/1/3/2/8/132815968/86925.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368989/normal_5f8c3d4a2bbc8.pdfIn PDF document text
    • https://mabanopovofed.weebly.com/uploads/1/3/1/4/131453130/subokajobupaxi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372985/normal_5f8a00036e881.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b3bce45c-4a2a-4770-bf14-8694538c3345/18503019766.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f32af0e9-8be2-47ff-b23a-e9902a7c6dc9/besarobulake.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cb4bf71-ee31-4f8b-8440-00ac17581d04/bailando_spanish_mp3_download_pagalworld.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/bharat_acharya_8086.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc412bc1-a017-444e-be78-a9e2b4c4a296/cell_membrane_and_transport_graphic.pdfIn PDF document text
    • https://s3.amazonaws.com/putelekireza/unwto_world_tourism_barometer_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/english_club_activities_for_primary_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bcd63fa-7dae-4de9-ac69-ad4ff589f1cc/genuvuledo.pdfIn PDF document text
    • https://s3.amazonaws.com/tabobujimo/can_kindle_read_ebooks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5dad720-b79d-4882-b94d-3d6acba04603/xozisefexofolomewanepe.pdfIn PDF document text
    • https://s3.amazonaws.com/wukara/wunojodofunodu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000596e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x596E 4556 bytes
SHA-256: 1f1d6f9015d8dac36209c7e0171017266f719adb313af8ffea998930836c36fa
font_01_sfnt_off000068f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68F5 10388 bytes
SHA-256: 3aee6c432323117f2fd4186222bfafda1d88166b8d59c00e4268b1a2ba312043
font_02_sfnt_off00008c49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C49 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.