Malicious PDF — malware analysis report

Static analysis result for SHA-256 405b3cb33d9d0381…

MALICIOUS

PDF

54.2 KB Created: 2020-11-08 11:04:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-01-15
MD5: 4aac8a7aff4893b22bea73dedbfe4616 SHA-1: 99a6e8503924796e1afa38cfa100776cfe0bc761 SHA-256: 405b3cb33d9d0381beae5a59886c3aedbcab224bebe7e0a699bbf037896b2a11
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?keyword=science+answer+key+2019 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366367/normal_5f8b3e1d80de6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365601/normal_5f8e6337b0a6d.pdfIn PDF document text
    • https://zewuxufasebi.weebly.com/uploads/1/3/4/3/134320084/xofikomo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402520/normal_5f964b6596960.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e91a20b-b861-4f2d-aafa-30dc4d840344/93742913357.pdfIn PDF document text
    • https://zotimopideda.files.wordpress.com/2020/11/vatazusasiwitanazimi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/acc70b37-7393-47fd-8d69-33a891c69f14/80536693668.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/354ae8b1-4ce8-4c5d-a92d-c1dfd01af0d7/labebigonugegivolim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbdae2ed-f800-4c69-86fd-51e4c7699fae/lesuderizasezes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46ce4730-93c6-4e3a-ac0b-ce748f807457/79211322655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47399331-2176-450f-b0fd-6f576ebc1593/foxijagijekope.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d041c6b-edde-4428-a630-354eecebc38a/jasetaleburuzo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66b55dbb-c19c-4431-a1b0-06a9e80cd580/84981229976.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ce82c3a-6eca-48ef-a3b2-977b6a82cd00/51840930975.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000a43b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA43B 22640 bytes
SHA-256: d5a8363ab615e597e6982c49a06cd111b5dbb8e43ebf4cfb7347d384805c60ce
font_00_sfnt_off00006b57.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B57 5604 bytes
SHA-256: 0efc12a2c6afc42b25344494d84867a749ec34e618cbcfcbd077de225f547dd3
font_01_sfnt_off00007e96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E96 10996 bytes
SHA-256: 20cfd8cbdff59c5475ec51dd7d42aa12454bdf1ea549a83e32e93501c3c0b675

Open this report in the interactive analyzer, or submit your own file for analysis.