Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a1f71bd40c2f7bf…

MALICIOUS

PDF

59.4 KB Created: 2020-10-14 17:28:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: fe1656c5bf08fb14e7be775e789519f8 SHA-1: be017f9f96d430d8f59862eaf13159a1e3cbfeea SHA-256: 7a1f71bd40c2f7bf1fae72eaa9503f96a5b719af35b433fbd795783a2ea97f31
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=best+wireless+sport+headphones+for+android In PDF document text
    • https://site-1039688.mozfiles.com/files/1039688/jizoruru.pdfIn PDF document text
    • https://site-1039768.mozfiles.com/files/1039768/10456300114.pdfIn PDF document text
    • https://site-1038733.mozfiles.com/files/1038733/luzesobeduvikusipago.pdfIn PDF document text
    • https://site-1040376.mozfiles.com/files/1040376/fugetuwuduxitugapu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365545/normal_5f87056eeb418.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366040/normal_5f87029ca602a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366028/normal_5f8708859551e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365589/normal_5f86fe80b61c3.pdfIn PDF document text
    • https://site-1038995.mozfiles.com/files/1038995/89809954171.pdfIn PDF document text
    • https://site-1037273.mozfiles.com/files/1037273/dikodujimebi.pdfIn PDF document text
    • https://site-1043651.mozfiles.com/files/1043651/34875003185.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365583/normal_5f86f6d2be887.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365607/normal_5f87044ec4008.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366048/normal_5f86f8e4e7c31.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365567/normal_5f8704122e084.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b46e462-3f2d-453c-b9e8-4a2f093d1d76/32005532300.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48a22fba-2481-4947-9e78-fafb30b0274b/xodojumotosamuloseseluv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50347f91-8613-4276-bbab-936e3f4b3332/poletenolak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0e5b317-d424-4a71-a896-e44f45ec05f1/44827454871.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5569b126-5d29-42ac-b3a9-5f0b6b72b5af/35433830971.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbe90885-2619-4d53-b2d6-62512204d4ef/betemujirusaxedufideribob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc74a32b-4215-45ee-b998-1116faabb7fa/26759962864.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000922d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x922D 5268 bytes
SHA-256: 025116f5d7116be87d7e56087a71689b70fe35ea36d75ed5738c94049300f06c
font_01_sfnt_off0000a41e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA41E 9760 bytes
SHA-256: 19775b3fe2c5c095f537b6fa912dc9f97248a55a234be71107a78c620c7883e8
font_02_sfnt_off0000c5ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5CA 17408 bytes
SHA-256: fe86042f9f6775fbc635d5d3e8adcac53ea2fe02508d3d4f6c15ade5f4f32c24

Open this report in the interactive analyzer, or submit your own file for analysis.