PDF malware analysis — malicious · a4689d6a855601cc

MALICIOUS

PDF

34.7 KB Created: 2020-10-05 07:42:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04

MD5: a517c6943cf3b5dcfd002da8df505383 SHA-1: 9376bc8d3af3820078c7487e939b513d0fff9282 SHA-256: a4689d6a855601ccd72607fb7de4d0a5b0b5fd47eb33528a59da9546ff46cfc2

192 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?keyword=en+barranquilla+me+quedo+in+english In PDF document text
- http://files.rooflinesystems.co.uk/uploads/1/3/1/4/131453124/e4f43c.pdfIn PDF document text
- http://foxerasuk.axeandroothomestead.com/uploads/1/3/0/8/130874038/nifunokiminazu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/0392/7973/files/the_after_season_1.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0438/8893/5067/files/tipos_de_autismo.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0433/6327/0815/files/dr_pepper_snapple_group_case_analysis.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/9495/3124/files/super_arcade_apk_2014.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/2004/0866/files/juzefesekolotefob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2a47d8c3-f2eb-4cef-a2ee-f8102e1f3d1e/46263551599.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c1476ec-e667-4797-801b-da00a384ea11/ruvematoraxexemavozapid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bab83bd2-340e-4cfb-abb4-bea4a96dd69d/mirefaxidugotowuwusug.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0460/7885/3284/files/grace_vs_law.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0477/0850/4220/files/netgear_wgt624_v2_manual.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0430/3123/2674/files/logic_problems_x2_mom_goes_shopping.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0485/2724/5467/files/vofukezatamun.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000066f6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66F6	5464 bytes
SHA-256: `47bd9c782c694c8cf967797e487e30fb050bdd233260a133565364282f497aed`

Open this report in the interactive analyzer, or submit your own file for analysis.