Malicious PDF — malware analysis report

Static analysis result for SHA-256 5314316f1b3c03b7…

MALICIOUS

PDF

45.7 KB Created: 2020-10-16 19:21:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: c79e83da838bba48c57b3f809edf1080 SHA-1: 7cdbfb449744bdb62237136e1947576f8f5de34e SHA-256: 5314316f1b3c03b7666f636419018fb9c2c72cd6fa2df53104c2bc6f1abed76f
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?keyword=freedom+app+apk+free+download In PDF document text
    • https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/zebapesuluboxaj.pdfIn PDF document text
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/linurigaruxox.pdfIn PDF document text
    • https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/zozesonefoviz-ruraxawojuzetu-naler.pdfIn PDF document text
    • https://xisubuto.weebly.com/uploads/1/3/1/3/131380177/49e4b3.pdfIn PDF document text
    • https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/8627562.pdfIn PDF document text
    • https://wonigebegi.weebly.com/uploads/1/3/1/6/131606731/54c86654.pdfIn PDF document text
    • https://fobewesepujub.weebly.com/uploads/1/3/2/3/132303403/ac7a055ad1.pdfIn PDF document text
    • https://wesoxiworikezux.weebly.com/uploads/1/3/1/3/131380467/7dafc251cf7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a4db872-1810-46ac-b746-7c34589fe5f5/30807280261.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69cdb5d9-8315-4939-b6f9-9042e699e782/ludokoribazasuzatemofiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aab2b82-7ddf-454d-863b-153d8c87af07/98476084521.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8af0472f-479f-425d-bb6f-bee9b731d36e/xilof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1095b1ae-ba08-4ddd-8b9f-eb7f1ed1e808/zekijagomisumokus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a55a3a7-5484-4b21-b62d-98a29f1ea881/23216223530.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9721/1551/files/81073460620.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/8591/2477/files/dedowometivozoni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31ce0e44-8d23-4c00-9569-0691e64428bb/68929303382.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bd76256-49ee-4083-b277-d5debde239a7/96286267189.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b683eb0-a78d-494b-84f3-d38d6edf7f69/1981386713.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1beb397-b33f-4dd7-b2ae-3900554efaac/sowokekav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8019342-8538-4792-b65c-eb97c1abf90e/ripiromelevufeto.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000754b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x754B 5120 bytes
SHA-256: ad92d6410c79cc4a8cef305ca17d95882a65472d763958ee2e57b359fa824a91
font_01_sfnt_off000086b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86B7 10032 bytes
SHA-256: 67629529feb6130ac911ddb125281ed8a747bcbc51ef06d2285f69fbbdc95ff1

Open this report in the interactive analyzer, or submit your own file for analysis.