Malicious PDF — malware analysis report

Static analysis result for SHA-256 623ff66d1e249ed4…

MALICIOUS

PDF

33.9 KB Created: 2020-10-07 21:36:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: ed9c883a416c5f8bc2f8dd485da29398 SHA-1: ea93dc22fec53021c41e8ed40205760a30b6d9d0 SHA-256: 623ff66d1e249ed45d5305bb7ce81fd6b1e37f890a0c48fa80e9a4f1faeec95d
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=functional+grammar+and+composition+pdf In PDF document text
    • https://site-1036820.mozfiles.com/files/1036820/88539931462.pdfIn PDF document text
    • https://site-1039906.mozfiles.com/files/1039906/79390128125.pdfIn PDF document text
    • https://site-1038331.mozfiles.com/files/1038331/pajimamu.pdfIn PDF document text
    • https://site-1044474.mozfiles.com/files/1044474/46436818574.pdfIn PDF document text
    • https://site-1037187.mozfiles.com/files/1037187/tenaworuzisanoxomif.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0427/6636/8935/files/pentagon_city_metro_station_parking.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0478/3151/5295/files/1450_to_1750_ap_world_history_dbq.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0460/7885/3284/files/wolf_scout_worksheets.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0472/2570/0517/files/qualitative_analysis_of_cations_pre_lab_answers_experiment_19.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0534c14a-32a9-4655-8f94-fe89b3d87f8d/78844251302.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67b5fa6d-834c-4b51-915f-653c260786ab/1920299272.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9be896e9-4542-403f-b4dd-c50cc37d9592/6445866903.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e89970d-a1a2-4e39-996a-d60d28cf05be/94099726695.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fe77ea5-34d9-42f7-b2d7-fbc3b5c9e8f6/42765134702.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f479f92-9a64-44b3-88ce-1f0e5b39ce92/zajorik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83652a34-343c-409b-a4d7-b25fa0ec941b/17172602361.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47A7 5432 bytes
SHA-256: 423acace177dc68a17b54119efd00d0db42bc8699253ae6c5b5f6e73ed390365
font_01_sfnt_off00005a0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A0B 9612 bytes
SHA-256: 371e6252fa644857f8bbb9ee6691329ae0158d5bbc0307b432fd543e064ff242

Open this report in the interactive analyzer, or submit your own file for analysis.