Malicious PDF — malware analysis report

Static analysis result for SHA-256 5766a6095e1466dc…

MALICIOUS

PDF

90.1 KB Created: 2021-12-10 03:04:33 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2023-12-11
MD5: bf450efc62ad9d4a3ac431004b2f05af SHA-1: 171aecf7eb81e80fb8d8c3a23a06f309af0cf36d SHA-256: 5766a6095e1466dc2dbcf01dc8ef76efda7dc85b3c1b51cdefff1ac694f5b8ec
99 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0242

Heuristics 5

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9780785837183&kwd=Nourishing%20Noodles%20:%20Spiralize%2075%20Vegan%20and%20Raw%20Vegetable%20Recipes%20for%20Delicious%20Healthy%20Meals PDF link annotation
    • https://files8.webydo.com/9589221/UploadedFiles/EB49E7E7-3302-9DBF-2D20-5E4BE66DC463.pdfIn PDF document text
    • https://files8.webydo.com/9589234/UploadedFiles/5629648A-7381-D5E6-5B97-527718993D48.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4660132/normal_61b1afd348eaa.pdfIn PDF document text
    • https://static.s123-cdn-static-b.com/uploads/4661671/normal_61b1a53a3b720.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00010543.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010543.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10543 21892 bytes
SHA-256: a013479a41a50f46b25ad7d0d12dc69b6f827dbb1faf85fad5bb357f0008e7af
font_01_sfnt_off00013854.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13854 20664 bytes
SHA-256: 195ca23b2653c2caee07f4cf2b693c0b221642ce459e750e4fdd8d3db910b193

Open this report in the interactive analyzer, or submit your own file for analysis.