PDF malware analysis — malicious · 3e2206b89a6ae52b

MALICIOUS

PDF

59.0 KB Created: 2020-10-15 19:39:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10

MD5: ebb86e2fd3f38d5b956a487a67599dd6 SHA-1: 6fca30a67c976c8e85059cc8f39c574d3626f3d5 SHA-256: 3e2206b89a6ae52b0f2d577a5686ed97d55fef1c0f65ceacc2c0312319f2f0b9

132 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/123?keyword=tap+tap+apk+pubg In PDF document text
- https://site-1044503.mozfiles.com/files/1044503/petokuke.pdfIn PDF document text
- https://site-1048273.mozfiles.com/files/1048273/43420529764.pdfIn PDF document text
- https://site-1041075.mozfiles.com/files/1041075/98705876305.pdfIn PDF document text
- https://site-1043400.mozfiles.com/files/1043400/sajim.pdfIn PDF document text
- https://site-1037202.mozfiles.com/files/1037202/jinos.pdfIn PDF document text
- https://site-1043328.mozfiles.com/files/1043328/54610271911.pdfIn PDF document text
- https://site-1039438.mozfiles.com/files/1039438/65452035513.pdfIn PDF document text
- https://site-1042720.mozfiles.com/files/1042720/33192396638.pdfIn PDF document text
- https://site-1039676.mozfiles.com/files/1039676/52087185435.pdfIn PDF document text
- https://site-1036699.mozfiles.com/files/1036699/27400639942.pdfIn PDF document text
- https://site-1038573.mozfiles.com/files/1038573/70476478938.pdfIn PDF document text
- https://site-1042867.mozfiles.com/files/1042867/tosigokasodoxanutoni.pdfIn PDF document text
- https://site-1048292.mozfiles.com/files/1048292/20867621389.pdfIn PDF document text
- https://bebamewikirebu.weebly.com/uploads/1/3/0/8/130874540/lanidufo_divop.pdfIn PDF document text
- https://wuwenivavubujer.weebly.com/uploads/1/3/1/4/131437756/xibuse-jetakofofik-vobakedejona.pdfIn PDF document text
- https://site-1042549.mozfiles.com/files/1042549/wowixelirorab.pdfIn PDF document text
- https://site-1042271.mozfiles.com/files/1042271/merge_online_free_without_email.pdfIn PDF document text
- https://site-1041384.mozfiles.com/files/1041384/bewuzojenul.pdfIn PDF document text
- https://fisotewefupug.weebly.com/uploads/1/3/1/0/131071176/7114067.pdfIn PDF document text
- https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/2022221.pdfIn PDF document text
- https://kidunaxu.weebly.com/uploads/1/3/1/4/131437100/dulefipalep_jobowajoxugo_wiribulelom_nuzigo.pdfIn PDF document text
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/8441923.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000698c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x698C	12000 bytes
SHA-256: `24a7103b52e4f2067698095bd5e40a6e6008ae44f587907447bf0d925559cf71`
`font_01_sfnt_off000090de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x90DE	4832 bytes
SHA-256: `078f409ee7e76724e91a12095a33116be7c6651759154911d0c8e4399b0d2b1e`
`font_02_sfnt_off0000a168.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA168	10884 bytes
SHA-256: `b6bf5f0162c0327183b5282920a9dcf44bf95480ac11188409b482aa2705b7b4`
`font_03_sfnt_off0000c697.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC697	16272 bytes
SHA-256: `691431afae01f124bf32881324d768d3fad04a71fe471f3390338dd136ba1a8c`

Open this report in the interactive analyzer, or submit your own file for analysis.