Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f95b87b61a4b9f3…

MALICIOUS

PDF

56.3 KB Created: 2020-10-17 21:58:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: fa96f4f3af981824048b8830ccdcb319 SHA-1: 23e32106c31774d2535b77ee2071648f44c3aa9f SHA-256: 9f95b87b61a4b9f32665ac61a1125bb19bfdb97c1e812e45c69e0fb3e097e6a9
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=libros+para+aprender+japones In PDF document text
    • https://liwevapazu.weebly.com/uploads/1/3/1/0/131071299/jugibolimeketavo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365601/normal_5f88d3377d65d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365628/normal_5f87d4df04c43.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366048/normal_5f89954a43ee9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367275/normal_5f875d4390e4f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365613/normal_5f8a8d9630056.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369646/normal_5f887e8e81164.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369183/normal_5f896147bad53.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378171/normal_5f8aeeb7a7392.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e34f7816-b717-4e36-a630-a251efa0a47c/la_condicion_humana_andre_malraux_resea.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8884d3b0-ce56-411a-84ca-9719b7b07279/81378110531.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b314041-ff32-4ed4-85dc-ced9cf5e9c01/mavakezusi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0012/6885/files/2006_fleetwood_pop_up_camper_specs.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/4174/3263/files/bojixokesogi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/4157/3022/files/music_paradise_pro.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/1702/6715/files/78792116853.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/4802/1401/files/audiosource_amp_100_for_sale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60ab6d2c-a677-49ce-8c41-b2a99420514a/19362021595.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b254f3a-b0eb-4bfd-a3ef-4f0c82cecea1/82082200733.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a13439a-94b2-41fe-a486-b6e6819910c0/94717885856.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d61a437-6a46-4138-9829-8df501961125/wifesir.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000090e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x90E7 3276 bytes
SHA-256: 59a6c4b722da81c055291158537eb4535088683bb769d7bb2aa1c711c35aaa5b
font_01_sfnt_off00009ca0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA0 5076 bytes
SHA-256: b1319ff74bdebbcde610e697944d64308cef3e6c42918d1d870c2dbbb575da35
font_02_sfnt_off0000ade4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xADE4 11132 bytes
SHA-256: 1de6b5530aac841ef51f8a5f805cdeea730516fe0e8f7c2d99064ec0a29a099f

Open this report in the interactive analyzer, or submit your own file for analysis.