Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a32ea3b49865b28…

MALICIOUS

PDF

43.1 KB Created: 2020-09-23 01:39:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-04-10
MD5: b66f340b720a293a8b87035f863d7ead SHA-1: 1d7af7dbebfbdc3d6b4191ba7e41c0e47f017620 SHA-256: 6a32ea3b49865b282a95dea21ca575f42d931972bdd696280b7e4d9f5b1acde6
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=young+dolph+major+label In PDF document text
    • http://files.iananthonycoleman.com/uploads/1/3/0/7/130776718/9342694.pdfIn PDF document text
    • http://rekeri.elainealec.com/uploads/1/3/0/8/130873843/vapotogomadapebo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/2325/5712/files/jovogemamovuveradolasimud.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/6467/1909/files/fesovireladugujubulexo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/2475/6121/files/traditional_music_simple_definition.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/3213/3278/files/rijipifebukaxuz.pdfIn PDF document text
    • https://e36d811a-8d26-4e0b-a668-63eb9cf9e55f.filesusr.com/ugd/6cf804_f58039383c8f471d994ce82629a1a8e7.pdf?index=trueIn PDF document text
    • https://770891b3-24b9-4cc7-bfb6-a14208419670.filesusr.com/ugd/1c8c1e_b711db48aee947ed93def585472e0f86.pdf?index=trueIn PDF document text
    • https://815d2715-6a5b-4a2f-806b-2da972769c18.filesusr.com/ugd/fa6f14_dabd40c018254e38ad52b82a7b2ed9ce.pdf?index=trueIn PDF document text
    • https://7ba3d779-43fc-4a87-92fb-7ef77a3b7109.filesusr.com/ugd/0dcf4b_f97f9c10e5c5477f99faa82fb7769951.pdf?index=trueIn PDF document text
    • https://45d32ccd-0b6b-411b-a597-8c1f25a5cfed.filesusr.com/ugd/275374_765c8bb8cda246f191d13b3cf89a799a.pdf?index=trueIn PDF document text
    • https://fcb4d56c-edd8-4f24-9749-3a74f70ee25c.filesusr.com/ugd/3eb4bd_419fc1adc40046039e848d89afc14443.pdf?index=trueIn PDF document text
    • https://3c6c6e00-e63c-4c1b-ab43-ea3d4968af16.filesusr.com/ugd/24853a_0d4c93ebff564c5597fcfca0f00ff837.pdf?index=trueIn PDF document text
    • https://b1b132d7-61bd-4ef7-9a2b-6b528ea4786d.filesusr.com/ugd/40512e_ccb74baff5e34b8e92e3654f2681f389.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006a29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A29 5372 bytes
SHA-256: 69b5d94954294d102c5b392e38614ff799a08458613b627ae9d4d6fcb60ae6b9
font_01_sfnt_off00007c45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C45 10476 bytes
SHA-256: 610f24d4978c5644c7551f6014debaf90a3c3ead3a31514618db57341c0393cb

Open this report in the interactive analyzer, or submit your own file for analysis.