PDF malware analysis — malicious · 8a09056a98269389

MALICIOUS

PDF

80.7 KB Created: 2021-03-07 17:58:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: c24a675775a04d7699b3257e94ff5b3c SHA-1: 361c037e1646da193a797c234a6a299cbab2157c SHA-256: 8a09056a9826938906beb41a44d98b3f9cbe1c073a97a24fff2328cf30194f63

162 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/123?utm_term=download+linda+costanzo+physiology+pdf In PDF document text
- https://todurudivi.weebly.com/uploads/1/3/4/3/134344361/a2e280.pdfIn PDF document text
- https://fijuzezakuxulow.weebly.com/uploads/1/3/5/3/135391315/23c706b.pdfIn PDF document text
- https://molawaxurot.weebly.com/uploads/1/3/4/6/134699933/9aa18213f.pdfIn PDF document text
- https://xikipavukageza.weebly.com/uploads/1/3/0/7/130776529/zidepobek.pdfIn PDF document text
- https://sewokowoxukipa.weebly.com/uploads/1/3/4/8/134846336/nexizuvarupeba.pdfIn PDF document text
- https://kipunazumalimak.weebly.com/uploads/1/3/4/7/134755782/6919896.pdfIn PDF document text
- https://modizotu.weebly.com/uploads/1/3/2/7/132740501/wemonoviriwogagukom.pdfIn PDF document text
- https://didekupava.weebly.com/uploads/1/3/1/1/131163833/386fde756d2c57b.pdfIn PDF document text
- https://surutadalonuta.weebly.com/uploads/1/3/1/4/131455158/267ec.pdfIn PDF document text
- https://soxoxalumowaju.weebly.com/uploads/1/3/4/7/134768556/1511045.pdfIn PDF document text
- https://balesiloruj.weebly.com/uploads/1/3/4/6/134671801/wimajerajife_remuweputafar.pdfIn PDF document text
- https://potisejomi.weebly.com/uploads/1/3/6/0/136092970/814891.pdfIn PDF document text
- https://bejeselujolir.weebly.com/uploads/1/3/1/3/131379719/ad8f703d1.pdfIn PDF document text
- https://gawopina.weebly.com/uploads/1/3/2/8/132814119/4296703.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/zabevog/lafesatugul.pdfIn PDF document text
- https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_5c99f4b30632457a9b2b90bbfa292cc5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fuwenoxuzasila/lagijaganobixovutefavi.pdfIn PDF document text
- https://s3.amazonaws.com/bisute/july_2018_calendar_excel.pdfIn PDF document text
- https://d2d110b1-dce0-4b0c-bed7-be24280b7a6e.filesusr.com/ugd/165585_700ace683857445bafcbd7d2c776cc41.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bamepofewalada/61601449981.pdfIn PDF document text
- https://s3.amazonaws.com/petubapizo/xanileka.pdfIn PDF document text
- https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_69f5ec3637cb4bb8af8cdfac9cd41361.pdf?index=trueIn PDF document text
- https://7835c217-6b95-46a1-915a-76cdebae3fe0.filesusr.com/ugd/debfb4_15a83010433b481f85fff810756c8634.pdf?index=trueIn PDF document text
- https://ea74ff18-003d-4094-8454-8d7e15e33abb.filesusr.com/ugd/50de67_edf8c2ecf4154100943746c5abfa89f0.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f324.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF324	5564 bytes
SHA-256: `3936eb8620ac6891c40b220e3ef6e29fbe041f28113f47b0d504cfcf8718b8dc`
`font_01_sfnt_off0001063a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1063A	1800 bytes
SHA-256: `51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0`
`font_02_sfnt_off00010ec8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10EC8	10972 bytes
SHA-256: `64015f5aa641e192c22ce64f8f27c1a847d139a08645feefa2a3fad656946a7d`

Open this report in the interactive analyzer, or submit your own file for analysis.