Malicious PDF — malware analysis report

Static analysis result for SHA-256 81c55e59f6593997…

MALICIOUS

PDF

42.1 KB Created: 2020-10-28 18:08:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-26
MD5: ff9da8b337ac7809534614a0329f55cd SHA-1: ba32891117b7d3ed64a2ee22ec79bc4caeceb35c SHA-256: 81c55e59f6593997e37a100c45faa94d7e4bbd1217126b3470dd36ea8e31f585
124 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=submersible+aquarium+pump+cost In PDF document text
    • https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/f4d4264b47f445d.pdfIn PDF document text
    • https://natizupasa.weebly.com/uploads/1/3/1/4/131437725/5229935.pdfIn PDF document text
    • https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/1673329.pdfIn PDF document text
    • https://xogexemufak.weebly.com/uploads/1/3/1/4/131437987/fbe3d7a430.pdfIn PDF document text
    • https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/5473886.pdfIn PDF document text
    • https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/9369973dfc6.pdfIn PDF document text
    • https://kobijetiva.weebly.com/uploads/1/3/4/3/134322382/6013c4f7.pdfIn PDF document text
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/7922058.pdfIn PDF document text
    • https://vonubaxuted.weebly.com/uploads/1/3/1/4/131452839/2373773.pdfIn PDF document text
    • http://www.ascendercorp.com/In extracted file (font_00_sfnt_off0000657a.bin)
    • http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_00_sfnt_off0000657a.bin)
    • https://s3.amazonaws.com/ruzumeb/ielts_speaking_cue_cards_with_possible_answers_download_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/tefexatasumasajepitunun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c514ffa0-a5dc-4506-91ee-b9a6254bba3b/xilibonexemigojizel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/836c337a-a6a5-45e1-843c-b026015eaf2e/girikelavikew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e90febf1-be57-4721-91c7-1f5f417dea42/xupomavumakamutopil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd1cdc37-fa6b-42ef-95ad-467f68ee97e3/piperug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c614cd77-ed8c-46c9-a02c-7ddc6aee84e5/kuduneda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd785234-542f-4822-86db-75059b72b8df/gre_quantitative_reasoning_practice.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisigetizoxif/vba_excel_learning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2968a9dc-60fb-457f-aa39-df2c7d5d4695/rukedugij.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn extracted file (font_00_sfnt_off0000657a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000657a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x657A 5448 bytes
SHA-256: 385e37f1001f0e0e0fb1219339e921be87eb2beed17ac3c1cd573f9b449dd619
font_01_sfnt_off000077e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x77E4 10420 bytes
SHA-256: afe7ac31e294c8fcd800f3a56a5de7bb2630c8cb1f08d2ae3dc505ba03a3b09e

Open this report in the interactive analyzer, or submit your own file for analysis.