PDF malware analysis — malicious · 715c64ceede98b7a

MALICIOUS

PDF

46.6 KB Created: 2020-10-26 00:01:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25

MD5: 97d195b4c71949affff57235b8ad7c31 SHA-1: 0b4bd79242124c6ca6974508810fc942decf21c9 SHA-256: 715c64ceede98b7a9564d6c786595a73736e4ab6e1485469f74056fa99900ae8

194 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=brave+browser+android+github+releases In PDF document text
- https://fitakizegeva.weebly.com/uploads/1/3/3/9/133999514/62be0.pdfIn PDF document text
- https://povelelowu.weebly.com/uploads/1/3/4/3/134331265/fivenerorojijetiw.pdfIn PDF document text
- https://debemalimuwu.weebly.com/uploads/1/3/4/3/134385929/20b61dc.pdfIn PDF document text
- https://sopowifumerage.weebly.com/uploads/1/3/4/3/134355846/54e4db.pdfIn PDF document text
- https://xedexebil.weebly.com/uploads/1/3/4/2/134235570/dopofuwumisesa_nosijod.pdfIn PDF document text
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/5441935.pdfIn PDF document text
- https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/nifowetese.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369173/normal_5f8b4ee4a0c27.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370996/normal_5f8866e2c0fa4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413566/normal_5f95f58048142.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369503/normal_5f888fe6642f4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0499/8011/3067/files/19642912638.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0503/2417/7093/files/6075413374.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0440/7777/7061/files/bewof.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0485/0083/4466/files/marilyn_manson_paintings_wiki.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6a4d1bd7-d921-4a7a-aaa9-dfb5821cb4ae/34735725254.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c961a8fc-5050-4610-a0dc-097ca7b70f57/joker_bathroom_dance_cello_sheet_mus.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb0b03ef-d7f9-4542-9f78-ac3dc8692e4a/nudibobemubajiputazek.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3f51def-960c-45fb-bf27-9c00b76e28fb/sum41_with_me_lyrics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1eed6266-d3ef-4f7d-9638-c9b255b3f03c/pexigivipozuwuwizetat.pdfIn PDF document text
- https://s3.amazonaws.com/gidibesuxi/buzezapabulob.pdfIn PDF document text
- https://s3.amazonaws.com/tetenifeme/79222857041.pdfIn PDF document text
- https://s3.amazonaws.com/daraniwekamidir/47322457292.pdfIn PDF document text
- https://s3.amazonaws.com/gupuso/photodiode_amplifiers.pdfIn PDF document text
- https://s3.amazonaws.com/zetare/performance_appraisal_ppt.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006aa5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6AA5	5428 bytes
SHA-256: `d376af6d544e91e6eae5a932a66c86fff5a3ddbe26a4444573e845a5814b9e82`
`font_01_sfnt_off00007d1d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7D1D	2316 bytes
SHA-256: `1cdd5981f94027e5584da8f5fc64ebcf6efa08342804011db039df0732b0148c`
`font_02_sfnt_off000087d4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x87D4	10776 bytes
SHA-256: `d7ceeffcf9a3fa91d4a0c907d064f47921972cbf7a0972f785171473d42442ae`

Open this report in the interactive analyzer, or submit your own file for analysis.