Malicious PDF — malware analysis report

Static analysis result for SHA-256 3909fabe7266da16…

MALICIOUS

PDF

45.5 KB Created: 2020-10-11 10:40:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-17
MD5: ba4596d6f84630e0796c5eb6d576111b SHA-1: 796742fa1057d9131980267c9168de21ef3e4101 SHA-256: 3909fabe7266da168272aa2cfaf37ef1c3bfb1907ad4e11508cbbc2155c08269
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=apellidos+in+english In PDF document text
    • http://xagogepuz.minotsleeperlibrary.org/uploads/1/3/0/8/130874254/dawizenap-vanuz-boginodiwokadur.pdfIn PDF document text
    • http://pemakibo.houseofcare.org/uploads/1/3/0/9/130969707/julasodufip_bulojur_soritenugub.pdfIn PDF document text
    • http://zofuzuzal.fudosanbunka.com/uploads/1/3/1/4/131407668/2162230.pdfIn PDF document text
    • http://files.ethancranke.com/uploads/1/3/1/0/131070604/8927760.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a989c5aa-20ab-405c-9d53-9b791a3d8e0a/fijigepexozevomudokobozox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc58e85e-54e4-48ae-a94b-9b674e8d300a/10022714979.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/7190/1347/files/rujafezibufalisijegez.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/9928/1821/files/amtrak_valley_flyer.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/7038/2490/files/giwudejifebazefiwogaja.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/8069/1101/files/25857053641.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/4387/5737/files/barnett_recruit_crossbow_string_length_chart.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6453/2900/files/66149098911.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/5533/5574/files/54473815070.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000603c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x603C 4904 bytes
SHA-256: b7dd2011572de7ef5461a979f9fd7194292c0113e20e56702a12b0b0fd485780
font_01_sfnt_off000070ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70EA 10500 bytes
SHA-256: 0d85f44cacb265e1d04745fae0ad75443b9d8045f2c8c5f6ebf7baf3eb1c141d
font_02_sfnt_off000094a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x94A3 16068 bytes
SHA-256: eaa138153142e1b202f6e132b5b79d2ae4483da1523e62d7c19f47fa5ad289e7

Open this report in the interactive analyzer, or submit your own file for analysis.