Malicious PDF — malware analysis report

Static analysis result for SHA-256 742f0a396aaaa811…

MALICIOUS

PDF

46.4 KB Created: 2020-10-28 20:13:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 05965fd75a9fdc81fe87b3cd22033965 SHA-1: d23789dc4a1d8416f98397924c189c5ff72637ec SHA-256: 742f0a396aaaa8111448af1e5019b837629c857368047c91b96c55c21a0bb1c0
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=oster+1000+watt+microwave+oven In PDF document text
    • https://cdn-cms.f-static.net/uploads/4407664/normal_5f991d2597e3c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366666/normal_5f8728e00bf18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368266/normal_5f910fd932d78.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369794/normal_5f8b509d1edc3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf024b9b-84ba-421d-b86f-79775d7e4fae/senco_slp20_parts.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/1035/5110/files/central_idea_definition_in_french.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ce33f5c-3770-4653-ad35-d01f1ef70b70/1378604814.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fc90e5d-19a4-4e6f-a925-e673a443225e/47007813126.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06b9ff6a-fced-42b8-b6ee-2789156599f5/luigis_mansion_dark_moon_gems.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/8317/9198/files/98683280205.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4957/3784/files/the_running_dream_summary.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/3071/5288/files/best_fighting_games_android_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/930fb5b5-8087-4cdb-8621-32e07ab99088/9097742465.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb70d845-dd56-4dd8-8f91-a153aeec7146/676686188.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a41239f-d79a-4ee3-9a9f-ebb734c2fb46/23143742901.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36a41b28-db85-40e0-9ab4-833821ff4d11/28612569058.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/745f6562-698f-465d-a832-61da565fcbb5/26777968601.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/103a0e2c-f20c-4c43-9ea7-d8425e847e50/26158837400.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/1066/8724/files/62362368143.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007712.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7712 5284 bytes
SHA-256: cde7cff72026800d9586f8c6e82036ad50675c376038e5eba09e87c550868a64
font_01_sfnt_off00008910.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8910 10452 bytes
SHA-256: 62b40558b5920de715353ec3c49b9f983bddd56e46382f082b53b6fe2a0a35f7

Open this report in the interactive analyzer, or submit your own file for analysis.