Malicious PDF — malware analysis report

Static analysis result for SHA-256 a15ed3537b23e164…

MALICIOUS

PDF

64.2 KB Created: 2021-02-18 15:27:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 0c6d510295f09683f19bbc5095c162d7 SHA-1: 1c2c469129a71c78db9dee4cf209c25948718064 SHA-256: a15ed3537b23e1649a06312c39121d52e4ec5215972f3488835834ab3be83d18
244 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/wix?keyword=amici+pizza+ii+new+port+richey+new+port+richey+fl In PDF document text
    • http://guitar.su/datasheet_lcd_16x2_hd44780wnrj1.pdfIn PDF document text
    • https://duzesoduvumasu.weebly.com/uploads/1/3/4/1/134131570/733a84258.pdfIn PDF document text
    • http://idealica-italiaofficial.site/153426715695ta91.pdfIn PDF document text
    • https://teviwodujote.weebly.com/uploads/1/3/1/4/131453741/sigoruwimafobu_wuxinugip.pdfIn PDF document text
    • https://viriparerari.weebly.com/uploads/1/3/5/9/135978168/wamavowatobevasom.pdfIn PDF document text
    • https://cdn.sqhk.co/dezuvosowato/ijiizja/93034393817.pdfIn PDF document text
    • https://mowuvesetotodoj.weebly.com/uploads/1/3/0/9/130969800/gawirofozonu.pdfIn PDF document text
    • http://businessoutsourcing.org/793413226765zhf3.pdfIn PDF document text
    • https://birijejukuz.weebly.com/uploads/1/3/5/3/135386669/kewoxowag.pdfIn PDF document text
    • https://cdn.sqhk.co/tefozakozup/jajgjf2/lefelofotaf.pdfIn PDF document text
    • https://jefilixepiras.weebly.com/uploads/1/3/2/6/132681342/ea5b23012e.pdfIn PDF document text
    • https://bifekanivixu.weebly.com/uploads/1/3/1/4/131408854/kitanelalofirexo.pdfIn PDF document text
    • http://anarchymedya.com/pasozubuwosaxeg1ol.pdfIn PDF document text
    • https://cdn.sqhk.co/bajipugotox/7ZAAhdX/noxezixoledu.pdfIn PDF document text
    • https://cdn.sqhk.co/bezizafosu/bphhBgf/78227327136.pdfIn PDF document text
    • https://wofexajolevesi.weebly.com/uploads/1/3/5/3/135302186/7717185.pdfIn PDF document text
    • https://cdn.sqhk.co/ferudati/jiiHAhf/jewisutupixonu.pdfIn PDF document text
    • https://cdn.sqhk.co/sikudile/TicheGJ/ios_launcher_apk_mod.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/blue_jackets_manual_latest_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/sorapobuk/64414368455.pdfIn PDF document text
    • https://s3.amazonaws.com/wezukep/45388374874.pdfIn PDF document text
    • https://s3.amazonaws.com/sepovutapakogaf/capacity_planning_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/gotitibekovi/12200954671.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bd6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD6F 5308 bytes
SHA-256: 04ba43b64fe3b965749c6c59c4d73cb510de85f47af0112153b9a4a6265777f2
font_01_sfnt_off0000cf7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF7C 10412 bytes
SHA-256: a91a0b87d34c6cac93ed364e03d92fdc75c9c3877a75859363692aa1d1f33dfe

Open this report in the interactive analyzer, or submit your own file for analysis.