Malicious PDF — malware analysis report

Static analysis result for SHA-256 45ec34104db04510…

MALICIOUS

PDF

38.2 KB Created: 2020-10-08 20:33:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: 9dc1abed3629053d97090398319a9f72 SHA-1: 7e26e7ad03188b80e060d0952d73765335e53249 SHA-256: 45ec34104db045108dec7265396918556fbcfd35f401b4d732482935c8be260c
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=the+college+panda+sat+math+pdf In PDF document text
    • https://site-1044184.mozfiles.com/files/1044184/87822678213.pdfIn PDF document text
    • https://site-1043086.mozfiles.com/files/1043086/gamefijinagares.pdfIn PDF document text
    • https://site-1039513.mozfiles.com/files/1039513/56296638206.pdfIn PDF document text
    • https://site-1043910.mozfiles.com/files/1043910/zigedateso.pdfIn PDF document text
    • https://site-1039617.mozfiles.com/files/1039617/fedesanepilal.pdfIn PDF document text
    • https://site-1037018.mozfiles.com/files/1037018/mesunoz.pdfIn PDF document text
    • https://site-1036750.mozfiles.com/files/1036750/tekarep.pdfIn PDF document text
    • http://roweta.centerformarxisteducation.org/uploads/1/3/1/3/131384424/7039684.pdfIn PDF document text
    • http://files.underthemidnightmoon.com/uploads/1/3/0/8/130874582/vetuvabovopi-bapidug.pdfIn PDF document text
    • http://pexemajos.micheleashlee.com/uploads/1/3/1/6/131636957/31389.pdfIn PDF document text
    • http://files.shamanmodifications.com/uploads/1/3/0/8/130813757/vivago.pdfIn PDF document text
    • https://site-1036957.mozfiles.com/files/1036957/82024468173.pdfIn PDF document text
    • https://site-1036950.mozfiles.com/files/1036950/xererafowobizexazijuduzof.pdfIn PDF document text
    • https://site-1043690.mozfiles.com/files/1043690/xunob.pdfIn PDF document text
    • https://site-1037010.mozfiles.com/files/1037010/48608025634.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4BFD 3216 bytes
SHA-256: 0669215c61ff2d443774504346e55765cefedc3dd16bac1b2047a3f2b382132c
font_01_sfnt_off00005786.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5786 5424 bytes
SHA-256: 4bdd1be8289581e993928a2e4af5b93acdee4123a10a7008c0b76a4c09af8a4d
font_02_sfnt_off000069d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x69D4 9928 bytes
SHA-256: b0feec487c68d0efa003d939081be80699aef07f60104fd1cc0b20528e9a05a1

Open this report in the interactive analyzer, or submit your own file for analysis.