Malicious PDF — malware analysis report

Static analysis result for SHA-256 a30fc537cbb255ea…

MALICIOUS

PDF

38.6 KB Created: 2020-10-15 02:11:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: defa18941030c8981cd243ad12c71e50 SHA-1: ec2fe4983c353d48efe63c39ce9128ee3efff71f SHA-256: a30fc537cbb255eaa0fd27b011eedf96ecb61e482902f6607740c2fbf43cd77e
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/pify?keyword=busybox+apk+download+android In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365608/normal_5f8783f095147.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366659/normal_5f871f0e4ba33.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366993/normal_5f878126f0979.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366316/normal_5f87733bb1fc1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366625/normal_5f8776874d873.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365612/normal_5f873a036a72e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367007/normal_5f877f945e76f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366668/normal_5f8731762877a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366055/normal_5f872d49b16ca.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6607cbb-41cc-4702-ac42-b6b19011f80e/pigopelanomubibogunometa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e162af3e-90b6-4f69-a87c-cee27aecb5cd/34739435180.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dde3f837-7d71-47e0-91d6-d14b08dd0002/kesotagobobefanob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c65a64b-19a3-43c3-ab7d-724430286297/nabugeminin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20c04aba-59e0-4c8c-a209-271b18ea82d8/pobiboxumejupile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ebc6d4b-2c37-4ec7-bbfd-db5db70135b8/minapibe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/236a5da7-3dec-4721-be39-a65b82c2f538/41865701644.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11627f59-6821-467a-a621-37c7be31f73b/86519753644.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14441b09-0b2e-4371-8c6f-3ee090fc0225/powiralakobunofijop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a66a7a70-3b25-4e0f-9421-8110ce49a8ed/84424827191.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a727d469-c01d-4959-b34e-40593e5f8b13/zawuruvavabumiwib.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000578c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x578C 5468 bytes
SHA-256: 97881b4e085263c335dd204d30f292066342af4a96eaae9f6c3c403308093c30
font_01_sfnt_off00006a4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A4B 10204 bytes
SHA-256: b7209c19559706b29569ea84a0ade3cd43828852bad0a105a4dd4c8c8e5e8992

Open this report in the interactive analyzer, or submit your own file for analysis.