Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bafb74e5e6dc10b…

MALICIOUS

PDF

43.7 KB Created: 2020-10-17 02:07:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 1b68bad8ea4679070b9efa6a91f77ee6 SHA-1: 36c49a9e36e13d583784c6a45dd9084c1a2881e7 SHA-256: 3bafb74e5e6dc10b27d83712fb161c0a1b8e1ec511f8e1ce189f83dc77a71083
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=financial+accounting+weygandt+9th+edition+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366376/normal_5f8a1ec9d85c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366402/normal_5f871bb211109.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366313/normal_5f872299dd830.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368951/normal_5f8a0c2cc144c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369343/normal_5f89339e21f8c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fd78991-9e3a-4a45-b83e-87c3f25c38f3/gomotexajejibuj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7fa788c-d288-4412-986d-9162c6a21c34/66140174497.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2693fecb-6291-49c3-a2fb-554c0cd6e12a/4924093737.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aae36ae0-e776-4a91-a7b9-e786274388f9/57848611356.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3ff9e12-6615-497f-8b2e-f45b1f6c296a/nelepenotirifa.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/0185/0273/files/parusifubaxoza.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/3806/4296/files/sparkmaker_fhd_review.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0493/7537/9622/files/95177664965.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f219c7da-1444-46af-8cbe-67f95a48d7f3/jamuj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d7a0541-0f46-4418-9b64-70b2e34301b7/jefamadit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11a06e59-50c1-4d82-84e5-f883d33278eb/bajotibibajopesebe.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/5348/0611/files/ordinal_numbers_coloring_worksheet.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/5055/5799/files/glen_mor_rso.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/0064/2721/files/yo_ho_ho.io_crazy_games.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/1281/6039/files/racing_games_that_lucky_patcher_can_hack.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C5D 5448 bytes
SHA-256: 9dafdb45fed7a1128a394002125b25eaa1bdbb3940953f5ef2a804fe4d0c4f30
font_01_sfnt_off00007efb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EFB 10092 bytes
SHA-256: 195d3bd1530a0bfe9be1f0bb5ea797f6a0486352a8b89564f07f74a969064576

Open this report in the interactive analyzer, or submit your own file for analysis.