Malicious PDF — malware analysis report

Static analysis result for SHA-256 69cf25ce509b02c2…

MALICIOUS

PDF

54.4 KB Created: 2020-10-28 13:00:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23
MD5: 686526d856a04d69d21226f972fcf1f9 SHA-1: 0a262c4fe1fa7f6f355d2e052c2fb7fc31e4a39d SHA-256: 69cf25ce509b02c2abab4116c3657dda5aa589a093a8ba960d85d68e001f90d7
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=dracolich+dnd+5e+stats In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369310/normal_5f87ce3e50279.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378853/normal_5f8b4ba454868.pdfIn PDF document text
    • https://porimejonawi.weebly.com/uploads/1/3/4/3/134368737/4463543.pdfIn PDF document text
    • https://dekobela.weebly.com/uploads/1/3/4/3/134332871/menavikakomup_dedolenidema_penatosukigeveb_denakusidaxu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366337/normal_5f8806e1c58b6.pdfIn PDF document text
    • https://vuzejugusu.weebly.com/uploads/1/3/4/4/134486163/8479678.pdfIn PDF document text
    • https://mojivimimujovo.weebly.com/uploads/1/3/0/8/130874437/xefafimofaxeparekuji.pdfIn PDF document text
    • https://rizulibix.weebly.com/uploads/1/3/4/3/134358491/kuturapegubojox.pdfIn PDF document text
    • https://sosegesidor.weebly.com/uploads/1/3/4/4/134465043/vinariwaraledere.pdfIn PDF document text
    • https://gejatovuri.weebly.com/uploads/1/3/1/4/131406669/349752e83.pdfIn PDF document text
    • https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/nijefakipo_fijesafelajesow_gumujaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9aa36762-1382-419e-bb3e-722de64b0e94/79497840770.pdfIn PDF document text
    • https://s3.amazonaws.com/degagaziv/zivuderaxufamelivakoli.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/nikiladu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6af08909-c806-4455-a616-5d0dcc04e0c8/40122180383.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e79da94a-9369-4b88-b950-c2d71c055428/7820847997.pdfIn PDF document text
    • https://s3.amazonaws.com/vogubivajavofu/10166099849.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/24717847165.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ccd6967-96b8-4d5d-b24c-3b20f524fd98/wuxewividugegumejujeruzu.pdfIn PDF document text
    • https://s3.amazonaws.com/falevi/67128849193.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75a626b8-6d7f-4950-b905-3f45496fdcbf/93991904931.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000082e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82E3 5152 bytes
SHA-256: aaed5d667f8ebf69e821aa3e800d319d2a9b56c9680181326df57700ad21140d
font_01_sfnt_off00009461.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9461 10104 bytes
SHA-256: 8f55745cbed4b078959fbaeb170036e29fec7d0a89b729ae311d8258502ca47a
font_02_sfnt_off0000b726.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB726 16068 bytes
SHA-256: 12bdfdd26b42687ed6d6e4673084773943fc64d80ea302008a05158b1f99f3df

Open this report in the interactive analyzer, or submit your own file for analysis.