Malicious PDF — malware analysis report

Static analysis result for SHA-256 adca558cf9f90a71…

MALICIOUS

PDF

45.5 KB Created: 2020-10-26 00:29:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25
MD5: e5116169fbd865c996e609b0372d4346 SHA-1: 33dcb21fc5694bb1882184cfb2b942fd5c693220 SHA-256: adca558cf9f90a71fe0e48b6a6916dd1396bae278c05976620501e8d11ca122a
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=oscillatoria+characteristics+pdf In PDF document text
    • https://figunetu.weebly.com/uploads/1/3/4/3/134353482/5d83e8.pdfIn PDF document text
    • https://rojusonevupa.weebly.com/uploads/1/3/0/8/130814232/3652035.pdfIn PDF document text
    • https://moxoviwepikiwu.weebly.com/uploads/1/3/2/8/132814726/b66267e3f67.pdfIn PDF document text
    • https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/zumalojijakevuw-saxado-gizoxefemo-vetonujavazuder.pdfIn PDF document text
    • https://rofexigu.weebly.com/uploads/1/3/0/7/130738805/01a8a640c6904ab.pdfIn PDF document text
    • https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/3393008.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/zavubas.pdfIn PDF document text
    • https://s3.amazonaws.com/jojitagifuva/deletuwovusotolepiwuneruz.pdfIn PDF document text
    • https://s3.amazonaws.com/sinadi/6193370606.pdfIn PDF document text
    • https://s3.amazonaws.com/lunojol/hospital_building_design_project.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/angular_2_material_tutorial.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/7756/7132/files/alarm_clock_in_android_example.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/2360/5153/files/32234392919.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/6780/0736/files/irokotv_on_android_tv_box.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/1386/5124/files/hi_viz_sights_mp_shield.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0495/9921/7827/files/87493335892.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4dc2581-4ae5-45bc-92ea-3c745c198788/pisalipegimosaguvibodijol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1df9cf5-1e92-4f67-9c01-bce07d7e1b96/vajusegalularazuxa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25c79e51-c593-482f-8658-51510b16d567/vizusitokoguwaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d285caf0-ced4-4905-b17a-367898aac293/sifogisofapijabolerolemif.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/16372245065.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/andres_bonifacio_talambuhay.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70C8 5268 bytes
SHA-256: 6a086d9ee29715ac4be5444e9ffd1a0d497d2e4102b0c66e9dc545d5462e53a5
font_01_sfnt_off000082a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82A2 11492 bytes
SHA-256: e2add8c7342631190e6b519bef2b97153572409a87c845382d9d8b140a050857

Open this report in the interactive analyzer, or submit your own file for analysis.