Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a263948f8f4a4c6…

MALICIOUS

PDF

42.1 KB Created: 2020-10-02 14:41:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: 3f32afedaf347808914f4784ec1f359d SHA-1: ebcab72304299aa78857b34228480140a1a457b2 SHA-256: 7a263948f8f4a4c6bd6f0eae4c322b7b9774ce009310792db171f46af16925bf
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=akkala+ancient+tech+lab+blue+flame In PDF document text
    • http://fufidub.wlcbands.com/uploads/1/3/2/6/132682892/3dfab8b.pdfIn PDF document text
    • http://joxonid.byptrampolines.com/uploads/1/3/1/3/131379730/6427354.pdfIn PDF document text
    • http://ropaledog.seattleimprov.com/uploads/1/3/0/7/130775792/78ef04d0.pdfIn PDF document text
    • https://site-1036685.mozfiles.com/files/1036685/62439895320.pdfIn PDF document text
    • https://site-1038851.mozfiles.com/files/1038851/42071707243.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/53d6bee3-bdbf-40ea-ab5d-4f38f1047080/sivuma.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21e0a4b8-9bf1-4560-b9c2-bd384d135a39/sabeju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a0ff03f-cd26-4c09-9841-fbfd3b37d956/47405288193.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77d2efc1-d735-4ab5-9a3a-442ac13d2f3b/51489983994.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0be63fd1-b55c-4bab-88d0-b61a5e5b0c96/51843210065.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd62d796-b88f-48be-8522-dcd30e9adacc/sogewegufowekiwejesivuza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7380bbe8-a192-42b8-8e5f-5152841532cd/pinaluz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03c9d6bc-71e2-4fce-b495-118539ba9645/49626867561.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000689b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x689B 5040 bytes
SHA-256: ac38c829d5881245d75077e69a7f6a6ca9b1d8fdb7c61411f7cebcdbc5e7284c
font_01_sfnt_off000079ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79AB 9940 bytes
SHA-256: cb2240a6eaf2b6c3186ecc9fac49851e2bb790c5fed988a7da2363096fce49f8

Open this report in the interactive analyzer, or submit your own file for analysis.