Malicious PDF — malware analysis report

Static analysis result for SHA-256 773a5e02666b914d…

MALICIOUS

PDF

39.3 KB Created: 2020-10-12 11:45:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: 3a57180c4d8ac0022cc45e988e3d5e17 SHA-1: 4bcfd13cef52b97f03eb8fd6a196aeb68fec1b27 SHA-256: 773a5e02666b914d0706d3212dad16eec23377f8dc2024039f1fefb3a095a6cb
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/pify?keyword=types+of+nouns+quiz+pdf In PDF document text
    • http://files.mycmississauga.com/uploads/1/3/1/4/131437982/titagow_xevajazin_zelerupomo_butazelixomemov.pdfIn PDF document text
    • http://files.serv4all.org/uploads/1/3/0/8/130814252/5193966.pdfIn PDF document text
    • http://bavuwilo.ritaauerbachpaintings.com/uploads/1/3/2/6/132682697/pafaxatetobob.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/45959b5f-4395-46d3-a528-abad3ec2459f/97304180469.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72b5bc33-5735-4094-bd3f-4e937f1084f3/zomejejulenukonoxagufupo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3147a348-f74c-40b0-9af6-7f4c7178db32/xonidusozodusajifapadu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c45a1fe8-a8c0-40d2-be7e-30a64424e40a/doliluvolit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b03f6a9-dc4a-48d5-876a-986d2c7b5cff/33384808597.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11219e66-8b07-4985-8ded-f6206b52d09a/17544952548.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b765909-c6e5-43dd-b96b-bdd4739638a6/keteninadumibobaponu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0465/2780/7646/files/buxosemovir.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/3893/3146/files/tarexi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/8073/6151/files/kexelalalibafif.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000590e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x590E 4924 bytes
SHA-256: 39e3d1b373c7dcdf3ed7048747438b02d72fa5f91a86c3c870ab35f4a129720d
font_01_sfnt_off000069f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x69F8 12008 bytes
SHA-256: abf991362ad6f989e70c67eda6d60eb07f47d15b540a94a88384fa511c49a683

Open this report in the interactive analyzer, or submit your own file for analysis.