Malicious PDF — malware analysis report

Static analysis result for SHA-256 972cfd02616152a1…

MALICIOUS

PDF

44.3 KB Created: 2020-10-07 01:06:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 1b1390a0f4bf47faf19de8e35a253cbc SHA-1: f884d3b3799ebb5dbea5cbd7b9a916f2ad8f52c2 SHA-256: 972cfd02616152a13afa0b35b879398510bec2fa6b4e9bfa23ca39d27939fd6d
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/pify?keyword=declaration+of+independence+printable+pdf In PDF document text
    • http://files.gimliwaterfrontcentre.com/uploads/1/3/1/4/131454238/rexij.pdfIn PDF document text
    • http://gosiketo.tmhcomics.com/uploads/1/3/1/6/131606938/67d96d0626e4a3.pdfIn PDF document text
    • http://files.nicolas-rigaux-photographe.com/uploads/1/3/1/3/131382274/debda29d300e.pdfIn PDF document text
    • http://sawevoza.iditarod100.org/uploads/1/3/1/6/131637814/936625.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/3980/9959/files/how_to_calculate_marginal_benefit_and_marginal_cost.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/8381/5325/files/85449225234.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0494/0385/5015/files/rslogix_5000_v20_activation_crack_rar.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/2717/1990/files/60370031305.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/6749/7880/files/secretary_of_state_north_carolina_business_search.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7dbbce1f-98ec-4ee2-9dc1-acd1a3725e32/jolitudakajadul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2d187a6-fa92-411d-8788-428d07e1d127/90708468064.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a70b57c4-2209-4911-a057-63be8154c524/90856908920.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d44ab4cc-bf7e-4280-bada-f6a6bed408e0/xewarogamulikogedotexozal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9318d2c9-0406-4435-bb93-051cf37af895/78576960911.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3f9c458-4e13-497c-83f9-b15a71095c8c/lufisibi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fe0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FE0 5112 bytes
SHA-256: 4ce5b90901b348cf1440f89ff363475b2d9de471845f5bee2b0a9134191c6f22
font_01_sfnt_off00007149.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7149 6148 bytes
SHA-256: 488ffee5e9c33bcc1f3f00aec749f35977d0cdd209ffadaee35194d66ecc177d
font_02_sfnt_off00008129.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8129 10204 bytes
SHA-256: f8b084ac47f42c95e69479f0f4211b5e69bfbbf1df9807d8bb208bfb10013fb0

Open this report in the interactive analyzer, or submit your own file for analysis.