Malicious PDF — malware analysis report

Static analysis result for SHA-256 386dbbae10a2bea2…

MALICIOUS

PDF

44.4 KB Created: 2020-10-29 00:23:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 3748e214b8076a5885334d3eb2dd9910 SHA-1: a29ff2b5d4500d3aa7a72fa99288c8e9f3917bf2 SHA-256: 386dbbae10a2bea2a1d263b03a57ae9fddf67e5cab2ce057154b257ce05d8fae
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=roblox+gift+card+codes+generator+no+human+verification In PDF document text
    • https://cdn-cms.f-static.net/uploads/4394062/normal_5f99b7e120b88.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374839/normal_5f8da0882d8d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378410/normal_5f998333741e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387420/normal_5f8e30e044fba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369316/normal_5f95ed4539dcc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382772/normal_5f8fe059c4dff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382976/normal_5f8bc8bb18551.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416934/normal_5f9536362544e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3feff54-9434-4f78-a4ea-efb7010e059c/58448563247.pdfIn PDF document text
    • https://s3.amazonaws.com/subud/20618687635.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9e3fd33-aa1b-45ea-be00-8ea97abf856d/tegapogoxovizepunuvibefu.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/31125472458.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28a72831-0c13-4ae3-aeda-475e91f1fe52/61138646611.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/adeept_ultimate_starter_learning_kit_for_arduino.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/astrologer_s_handbook.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/53718444283.pdfIn PDF document text
    • https://s3.amazonaws.com/tamobalasu/35826974034.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/8270284718.pdfIn PDF document text
    • https://s3.amazonaws.com/wotodedaruzuk/12973167960.pdfIn PDF document text
    • https://s3.amazonaws.com/nopomewegobij/antibody_structure_instability_and_formulation.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/73435554945.pdfIn PDF document text
    • https://s3.amazonaws.com/tadovu/66932806656.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0cdfe780-8b80-4a3c-883c-9757a55e0d08/htc_desire_310.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C76 5708 bytes
SHA-256: cb4b601c19c245dc207eb494675b98c24fdd88c97a92d280e86e232330b9996c
font_01_sfnt_off00007fd6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FD6 10336 bytes
SHA-256: 54f42d20e5fa8dd897721db534b8dfcbf0366069c27da5294a0f158752283bf3

Open this report in the interactive analyzer, or submit your own file for analysis.