Malicious PDF — malware analysis report

Static analysis result for SHA-256 473f2e81a181b490…

MALICIOUS

PDF

47.7 KB Created: 2020-10-04 06:07:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-19
MD5: 2db0927015f318a31e6ba746a54b5395 SHA-1: 92a20393c984a9b38f35acb61dd6557512371687 SHA-256: 473f2e81a181b49095e745a60545b431d40a729a93b942609e26945cd7f21218
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/pify?keyword=you+reap+what+you+sow+meaning+in+marathi In PDF document text
    • http://files.mollyberesforddesign.com/uploads/1/3/0/8/130874559/6197ce5a4c.pdfIn PDF document text
    • http://tekiwef.thecheesewizard.com/uploads/1/3/1/4/131413603/govub.pdfIn PDF document text
    • http://files.bettelovestudio.com/uploads/1/3/1/4/131437987/wutalenutuzewomana.pdfIn PDF document text
    • http://files.myfairladyministry.com/uploads/1/3/1/8/131857527/jipelidige_wozif_kotetebik.pdfIn PDF document text
    • http://files.lighthouseliteracyconsulting.com/uploads/1/3/2/6/132682528/kupimira.pdfIn PDF document text
    • https://site-1038351.mozfiles.com/files/1038351/84842517035.pdfIn PDF document text
    • https://site-1040612.mozfiles.com/files/1040612/56090533755.pdfIn PDF document text
    • https://site-1037884.mozfiles.com/files/1037884/8449863476.pdfIn PDF document text
    • https://site-1036805.mozfiles.com/files/1036805/fifepimokirofari.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5112df1b-09ae-4848-b768-cb84d8385657/40084198980.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e9bba89-6044-4cac-90ed-313b364dd3d5/bojuwalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f813cd9e-fd17-4437-afb5-d9ff6a596171/85528904005.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/514921c9-6a04-4cb0-88f1-571fe0d483bc/pilelakulepazogava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce3960c7-1140-42a5-b327-8c2ee1d45427/luvatozuba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9692196f-7888-4297-a18c-12373ff55114/93682151885.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e52e1c73-08e2-4cf2-9842-8915dffa76a1/47462805041.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006243.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6243 5356 bytes
SHA-256: 96f44402bd1c5372650a8356d75762f4243474a34c59e43de12bb4a2189a8818
font_01_sfnt_off0000742c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x742C 6340 bytes
SHA-256: 9159c3bbe4e617fc6ab21800076b31c718e0e83db4142b903295bba04c9b58a9
font_02_sfnt_off000083b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83B8 1680 bytes
SHA-256: debaf3ff37cadd88e03f56a1da1b20b0676acbb0c2dfc7de7569b922f44b7b54
font_03_sfnt_off00008c05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C05 10900 bytes
SHA-256: cbe240e4fd6e6eb456a7a2861200513e495423571cacc8c0d6383ecb69dad6b1

Open this report in the interactive analyzer, or submit your own file for analysis.