Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b6d23526e4ca2c3…

MALICIOUS

PDF

44.8 KB Created: 2020-08-21 00:25:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 45901a5f8de0e20c2e7bea88f5086d59 SHA-1: 3bbdf86e32191550e3fabab1950d6ef53115da4b SHA-256: 5b6d23526e4ca2c33bfa264368a6f890325810ee604bf679cd01d535a8fb16ca
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=vidmate+apk+2019++install In PDF document text
    • http://wuvukilu.tammiesmuffins.com/uploads/1/3/2/6/132681670/24335adfcad.pdfIn PDF document text
    • http://pobenut.fairytalesandwar.net/uploads/1/3/1/0/131070420/e5597cb612.pdfIn PDF document text
    • http://files.leapvisionproductions.com/uploads/1/3/1/6/131637108/lenifof.pdfIn PDF document text
    • http://files.jimstopher.com/uploads/1/3/1/6/131607131/cddeca5f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/dosoxuwananeworatimuk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/4884/3929/files/blast_furnace_operation_process.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5820/8672/files/69941128518.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8671/6830/files/jusosakavulafoxakig.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/8370/1151/files/kalnirnay_marathi_2016.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7405/9430/files/wuvifexejimuwete.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/2820/0096/files/nodomuxojifugodogozenuk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/3765/5191/files/41981973164.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/7588/7523/files/jezokeregeperat.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/5266/1912/files/58638255744.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/2588/2518/files/worksheets_for_kindergarten_writing_alphabet.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/6877/4814/files/10271419592.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65E5 2952 bytes
SHA-256: e211f2d6e0d1bf1fd17bd5150bc2724fb7c0f1d37b1c69b855d9dcad8de34ab0
font_01_sfnt_off00007073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7073 5520 bytes
SHA-256: 685b96a200cdf0384bef9c7d105e3b32ccacaa57f07150f0419beb546d268803
font_02_sfnt_off0000832b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x832B 10288 bytes
SHA-256: f42fddc43a0990138b279e5e53858765a6f747e416d8f4accfc2ca76a2fffe04

Open this report in the interactive analyzer, or submit your own file for analysis.