Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f4f9cc370e34c9d…

MALICIOUS

PDF

79.8 KB Created: 2021-03-20 06:31:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f4c644f217e0463e8e8bf6a48d1d7c4 SHA-1: 70bf9a1eec693c62d7822780cab17b47cc17eae6 SHA-256: 3f4f9cc370e34c9dd800afd37bdb41e565c9e95e3bae4a0347ebcdb13a2f3116
98 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • ClamAV scan did not complete info CLAMAV_SCAN_INCOMPLETE
    ClamAV scan on this file did not complete (ClamAV error (exit 2)); the verdict reflects only static heuristics. The result is not cached so a later submission will retry the scan.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=tokyo+ghoul+season+3+episode+13+explained
    • https://cdn-cms.f-static.net/uploads/4419828/normal_6055039e7deba.pdf
    • http://re-prime.ru/2008_dodge_grand_caravan_headlight_bulbxzx1x.pdf
    • https://vigowumiluz.weebly.com/uploads/1/3/1/3/131398530/28cf8.pdf
    • https://kilekofizinovi.weebly.com/uploads/1/3/3/9/133997912/5a2edd94e3.pdf
    • https://cdn-cms.f-static.net/uploads/4448976/normal_601ef08e94cd3.pdf
    • https://nekegofoka.weebly.com/uploads/1/3/4/3/134364724/sizebi-felaj-bizigowibi.pdf
    • https://static.s123-cdn-static.com/uploads/4489587/normal_6007d14e80008.pdf
    • https://lafezarawowaw.weebly.com/uploads/1/3/0/8/130874252/jijimula.pdf
    • https://fomemavinujidi.weebly.com/uploads/1/3/1/4/131414297/fd6e83d4183a9.pdf
    • https://cdn-cms.f-static.net/uploads/4465257/normal_5fe7968fb50e4.pdf
    • https://cdn.sqhk.co/tutabudoxuwa/b1iaE3t/free_wifi_drivers_download_for_windows_10.pdf
    • http://moneyindia.site/gebal7wf9g.pdf
    • https://cdn.sqhk.co/terodekijur/Zjfiigh/vikurarojalixamefu.pdf
    • https://gazewowotom.weebly.com/uploads/1/3/4/6/134616189/sopawezipenajat-wififige-gogelegudulikiv.pdf
    • https://cdn.sqhk.co/gadewekunel/igghaic/national_test_abhyas_sign_in.pdf
    • https://cdn.sqhk.co/jezumasulej/aibighd/wezetupadobogok.pdf
    • https://cdn-cms.f-static.net/uploads/4447663/normal_6032b1acc4f00.pdf
    • http://javasuk.epizy.com/bluffton_ohio_police_reports.pdf
    • http://dinuwulorixipe.epizy.com/best_shows_available_for_on_netflix.pdf
    • http://vabanenutulaki.rf.gd/cambios_fisiologicos_y_psicologicos_durante_el_embarazo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Open this report in the interactive analyzer, or submit your own file for analysis.