Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ca3ab5169da71f4…

MALICIOUS

PDF

63.9 KB Created: 2020-11-07 06:47:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23
MD5: 6e32fb55e2e4ca355d88e2f8319ed9fa SHA-1: e909deeb668ecf520b1a002a7d65fd43b524f714 SHA-256: 6ca3ab5169da71f474fc7af9e1ac6fe4581f93acda50b6b7e2c0b23ea4c284c2
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?keyword=ap+world+history+unit+1+test+answers PDF link annotation
    • https://lekolusogi.weebly.com/uploads/1/3/4/3/134365603/8727912.pdfIn PDF document text
    • https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/8276696.pdfIn PDF document text
    • https://roxunasof.weebly.com/uploads/1/3/4/3/134312726/finobigeb.pdfIn PDF document text
    • https://rujovisaz.weebly.com/uploads/1/3/4/3/134328318/4376984.pdfIn PDF document text
    • https://takaranedo.weebly.com/uploads/1/3/4/0/134017801/d2983be47ae23d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8176709d-ef5b-4275-85dc-c0f20019f3f3/74856373530.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8383d1e-959b-4cab-94ca-6dc146df0270/rabikawadilopituj.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/52714728113.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a78ad5d-40e4-4858-8b5d-735205276099/borotugax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb5269bc-6a64-467a-a46f-ef930804f906/pictures_of_the_overworld_in_minecraft.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ddbaaecd-4b51-4c16-8a65-290b12eb7da5/norton_field_guide_to_writing_with_readings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd3932c3-1375-458e-b7d8-f5bfc2f9fa17/85540871808.pdfIn PDF document text
    • https://s3.amazonaws.com/nokiva/mofezoda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2db17d16-46d7-4173-8a8b-6d8cd45176f0/49473087551.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000631c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x631C 6872 bytes
SHA-256: 46c6ad6f5141016dd22db0e8b34242e49ef9b3ba32fdcc6cce8b0ed0ca66b897
font_01_sfnt_off00007472.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7472 5284 bytes
SHA-256: 182ef095c1c5ec8a7acdc9e9c489be543e271831e441606931db101dd0e5584a
font_02_sfnt_off0000866f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x866F 10796 bytes
SHA-256: 3a5a923e56816e1f584b0093903a63c18af158816538ef105cb838cd272b68a6
font_03_sfnt_off0000a888.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA888 12980 bytes
SHA-256: f12c2cd5eb50679ddabb9a47ed88cf275be270ed90837a7d444afe23970c552f
font_04_sfnt_off0000d381.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD381 16036 bytes
SHA-256: 354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb
font_05_sfnt_off0000e7d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D8 1736 bytes
SHA-256: 74be5bc4d46f64e5c506ae1006f7022dc98ebf960e37c7bf417c2027ca73106d

Open this report in the interactive analyzer, or submit your own file for analysis.