Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e366933724f1cad…

MALICIOUS

PDF

57.1 KB Created: 2020-10-03 04:56:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-17
MD5: c2fe250da6b4a025b334382cf013b0e5 SHA-1: 0513f12132ef5011b3e7e11b965808d0605e3134 SHA-256: 8e366933724f1cad4538d496f1f2fcc132010dae86291e02e6971b56e761366e
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=vertical+farming+presentation+pdf In PDF document text
    • http://files.erjurself.com/uploads/1/3/2/6/132695995/nibodivinafatu.pdfIn PDF document text
    • http://files.luckwoodworking.ca/uploads/1/3/0/7/130740146/sinewosipoluvakim.pdfIn PDF document text
    • http://tewov.aatp-mysterygames.com/uploads/1/3/0/8/130814347/27e981b01ec15.pdfIn PDF document text
    • https://site-1039583.mozfiles.com/files/1039583/furasuwezejute.pdfIn PDF document text
    • https://site-1036754.mozfiles.com/files/1036754/lokumile.pdfIn PDF document text
    • https://site-1037019.mozfiles.com/files/1037019/45744511558.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/acd30ea9-e802-4a6f-b01a-24a9d5e0d687/84107712099.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fe976a9-6c39-43b6-b434-c6d363f1d523/garexunaruzewiduxajavin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a83e243a-d59d-4122-b81b-a47a3ee616fb/43370268316.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3958d8b5-9d89-44fa-a3a8-fd7b696ed484/xugafonujiwobatuni.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6de95e9-9cd6-43e1-be4b-62207903b5e0/wuxenavubem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f457d3ec-23e0-439a-8264-231f3f2641f9/62556785656.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7b314c1-b10f-484d-9758-414fabf833e8/bofomutufakugeguw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a082.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA082 5440 bytes
SHA-256: e5f60c5f6afd9a4cd891c9a04a48386ea80fd349e65a789e3b0eea479a9f89df
font_01_sfnt_off0000b2ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB2EF 10748 bytes
SHA-256: 160490d9f852cd82eb037d8ebca225d83d7b6ddfc619582cb183e78bb20d2701

Open this report in the interactive analyzer, or submit your own file for analysis.