Malicious PDF — malware analysis report

Static analysis result for SHA-256 408a3623877d513a…

MALICIOUS

PDF

40.9 KB Created: 2020-11-07 02:10:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2022-06-20
MD5: 292586120bd6f09f2b922619171297d4 SHA-1: f1f10a2b62cc64dddec9889d48474a5962a2ab8c SHA-256: 408a3623877d513a3075863573167426dd1c9886e2b94908e088d48f49967f24
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=shades+of+meaning+worksheet+3rd+grade In PDF document text
    • https://cdn-cms.f-static.net/uploads/4416149/normal_5f9b72bb301d1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366308/normal_5f881e901995e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xazarujokemus/nesixikufogoro.pdfIn PDF document text
    • https://s3.amazonaws.com/gebukil/lidugemijanuvol.pdfIn PDF document text
    • https://s3.amazonaws.com/bugutaj/bdo_ramlo_amity.pdfIn PDF document text
    • https://s3.amazonaws.com/naxizugenabi/assessment_and_management_of_medically_unexplained_symptoms.pdfIn PDF document text
    • https://s3.amazonaws.com/salade/cyrex_array_20.pdfIn PDF document text
    • https://pifakimep.files.wordpress.com/2020/11/fododuxuxinoni.pdfIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/39195734838.pdfIn PDF document text
    • https://s3.amazonaws.com/zosevid/x2_aspen_dighton.pdfIn PDF document text
    • https://s3.amazonaws.com/zowejunef/sssniperwolf_minecraft_videos.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/cancer_step_outside_the_box.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/ba_bed_syllabus_2019_in_hindi_download.pdfIn PDF document text
    • https://s3.amazonaws.com/dumupa/tecumseh_carb_adjustment_manual.pdfIn PDF document text
    • https://dipadek.files.wordpress.com/2020/11/bubex.pdfIn PDF document text
    • https://s3.amazonaws.com/gexixixuda/25596246879.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000052e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52E4 5500 bytes
SHA-256: 9ebc07f18bcfe0e0646b345902354372b69ef795d9663fb1a0bdf4ce7a6c4d5e
font_01_sfnt_off00006581.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6581 10220 bytes
SHA-256: 28bbf084f6a5872dce0aa0fe52c37f7c25f24f64161e60b6ed3e2910dd7afee7
font_02_sfnt_off00008841.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8841 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.