PDF malware analysis — malicious · 7fb83badfb374172

MALICIOUS

PDF

47.5 KB Created: 2020-10-11 08:41:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25

MD5: a9850a4b55da6cdb7f30a7d50d8ed5ef SHA-1: 82e6604a52317f18f2df5d93f528155d1502ca1a SHA-256: 7fb83badfb3741726f2e8cda0caa31e6ddf1ee45effa8dfb6ba8319f7b798913

182 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=missile+guidance+and+control+systems+pdf In PDF document text
- http://zibuva.morninglightclipper.com/uploads/1/3/2/6/132695517/5555071.pdfIn PDF document text
- http://xapob.eudoniaacademy.org/uploads/1/3/1/4/131452782/4332628.pdfIn PDF document text
- http://files.jasoncons.net/uploads/1/3/2/7/132740182/9bdb0f2de3f45.pdfIn PDF document text
- http://files.juelzofthenile.com/uploads/1/3/1/4/131438639/c0d416dc6da.pdfIn PDF document text
- http://files.edinburghcorporate7s.com/uploads/1/3/2/7/132741397/7d02e.pdfIn PDF document text
- https://site-1039772.mozfiles.com/files/1039772/19855210102.pdfIn PDF document text
- https://site-1048479.mozfiles.com/files/1048479/83806831891.pdfIn PDF document text
- https://site-1036957.mozfiles.com/files/1036957/rulegimaxunesi.pdfIn PDF document text
- https://site-1040675.mozfiles.com/files/1040675/xojizijaxafugosaxedidegi.pdfIn PDF document text
- https://site-1043040.mozfiles.com/files/1043040/68347700300.pdfIn PDF document text
- https://site-1037160.mozfiles.com/files/1037160/37359749522.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0429/7952/4759/files/das-2_sample_report.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0434/2802/0373/files/28633653600.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0481/7754/5365/files/uc_browser_mini_apk_download_apkpure.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008a60.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A60	5580 bytes
SHA-256: `08515af1760b440291d20a776994951715aa80b38d6f10b3e4f8096c8877660d`
`font_01_sfnt_off00009d53.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9D53	9916 bytes
SHA-256: `50e810fc5fe6a9b1c86ef8bb954ce7d3b852e5f8b574c4c2e9f771b396ffe732`

Open this report in the interactive analyzer, or submit your own file for analysis.