PDF malware analysis — malicious · 794182f0e9b46af6

MALICIOUS

PDF

61.3 KB Created: 2020-10-26 23:39:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23

MD5: c166221467a8dc5231ddd8e87d2a8983 SHA-1: d33b6c21260d2a1b74e83f69cda2b9b4d0fd6822 SHA-256: 794182f0e9b46af6b50d571434c61ad2b7d96d66ce5744fd5a0b67f2bf044a4c

194 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/123?keyword=molarity+of+household+vinegar In PDF document text
- https://feliwisinawo.weebly.com/uploads/1/3/1/8/131856919/pulitesirek.pdfIn PDF document text
- https://remewizefo.weebly.com/uploads/1/3/1/8/131856163/5191581.pdfIn PDF document text
- https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/e9d59c.pdfIn PDF document text
- https://dewubonate.weebly.com/uploads/1/3/4/4/134466502/pipiriwapotisa_musasapel.pdfIn PDF document text
- https://xemifedawunata.weebly.com/uploads/1/3/0/7/130775780/6511370.pdfIn PDF document text
- https://gevafitasib.weebly.com/uploads/1/3/1/3/131380901/c25f730.pdfIn PDF document text
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/f9007.pdfIn PDF document text
- https://vujofuda.weebly.com/uploads/1/3/4/3/134375628/2448776.pdfIn PDF document text
- https://jawogebewo.weebly.com/uploads/1/3/4/3/134369376/vugajamalot_fikajadimolig.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374957/normal_5f9237267f035.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366377/normal_5f9439015275a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://s3.amazonaws.com/rimepusox/lawotirosujerugiwaj.pdfIn PDF document text
- https://s3.amazonaws.com/jofunozuzof/kekezadij.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files2/tatalaksana_penyakit_jantung_koroner.pdfIn PDF document text
- https://s3.amazonaws.com/subud/79342657171.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/53213321918.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0437/6153/3089/files/student_portal_dps_detroit_login.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0495/8024/5144/files/67797453801.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0497/8494/6850/files/osteoporosis_guideline__2020.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007b7b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7B7B	3528 bytes
SHA-256: `f72fa465cd964a7759aa628be47d9d878e4093c6b4aed8091bec57f1609c9feb`
`font_01_sfnt_off0000882f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x882F	5336 bytes
SHA-256: `be13221ab5d0e402017c432ff965c564a373e217915d72cfb4572e63c1ffe6ad`
`font_02_sfnt_off00009a5b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9A5B	6148 bytes
SHA-256: `488ffee5e9c33bcc1f3f00aec749f35977d0cdd209ffadaee35194d66ecc177d`
`font_03_sfnt_off0000aa3b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA3B	11632 bytes
SHA-256: `6d11a3b99ee2f7727e61b7a755a8726b8779077b11e3f54e652065f93f029501`
`font_04_sfnt_off0000d21c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD21C	16096 bytes
SHA-256: `292b67320f20e7e38814323bff47001ccb55b5eebb397aea8a254f3e91f57b87`

Open this report in the interactive analyzer, or submit your own file for analysis.