PDF malware analysis — malicious · 5e2e901fad385496

MALICIOUS

PDF

41.3 KB Created: 2020-10-16 09:45:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10

MD5: bcc835399b2390a0c2a00d559a48d87d SHA-1: 47ac46c11f150b27a9ebbb27bf673bb0dc83abc1 SHA-256: 5e2e901fad385496820c50e8121bed81364d8c7c5f50b525675ea5e356ffbe5e

194 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/123?keyword=ducati+848+streetfighter+manual In PDF document text
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/8925184.pdfIn PDF document text
- https://nukevokisoget.weebly.com/uploads/1/3/2/7/132711970/regamafizesoxidiwed.pdfIn PDF document text
- https://noxepelobisuse.weebly.com/uploads/1/3/1/8/131871648/tewifarogufiveloxebe.pdfIn PDF document text
- https://lupolaluxu.weebly.com/uploads/1/3/2/6/132681144/8584300.pdfIn PDF document text
- https://vibebivenef.weebly.com/uploads/1/3/1/4/131412032/zewija.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0477/6303/0172/files/pitokidutotuwap.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/4914/8828/files/rovusolojovowidilozikese.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/4272/6310/files/jozumugesimipibobo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/1408/5544/files/47509466978.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0496/4751/7845/files/ruger_sr22_owners_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/6498/6266/files/9527851453.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/051a93fb-ebf3-4fb5-97aa-ef4d7f5869ea/37740418063.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd6bcc07-3512-4a36-bb23-2fc66dd57d96/wexefumigalaxijaza.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4215cef6-bd0c-4037-9c24-569ac918acdb/60543663241.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d071341-d2d8-41b2-bcf7-b8bf861ba148/54155848549.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5cb09a0-3ca1-42cd-bd7f-0d55c8fb2e3e/47238896119.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4256d63b-beb3-429d-b37f-6edd7bdcb8c2/69581258743.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9bdf161-2a0b-4411-8466-7b37c99750a4/15716971676.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb0869be-2af7-4870-8ac1-e391149b7088/78355510877.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/84909a45-c292-40c9-9001-4b0637f97df8/34382111075.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5ef6e857-ca02-4858-9c83-0ce3222faa29/buzabimekil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd9fa6cc-bab0-4006-8330-4dd6438c2ed0/96867314372.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000056a9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x56A9	5348 bytes
SHA-256: `91547bebe4386e6941bbf8becd24c6cb846e0f201c06bebac5830d3df3257246`
`font_01_sfnt_off000068b4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x68B4	9600 bytes
SHA-256: `a519e72af0572866a8e65ed179e9c3ef5accf85833e53b187bf46ed78dcb4043`
`font_02_sfnt_off00008999.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8999	4324 bytes
SHA-256: `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`

Open this report in the interactive analyzer, or submit your own file for analysis.