Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae9517c03d2e39d9…

MALICIOUS

PDF

68.7 KB Created: 2021-03-06 19:23:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: 97f3ab3e519d1f1f000563b5974ff5a5 SHA-1: b6efee41c3945970c9f64113745bdd1e9e87b67d SHA-256: ae9517c03d2e39d9e10fcd9960888204ef175a0446cbefb911e23cde73d7b1a1
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=2008+ford+explorer+sport+trac+owner%2527s+manual+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4460058/normal_5fd9c0e103465.pdfIn PDF document text
    • http://jalazekesofijot.medianewsonline.com/50740424784.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422637/normal_6008a3c998ca4.pdfIn PDF document text
    • http://gemubanabugawa.mypressonline.com/the_lightning_thief_chapter_15_questions.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/bleaching_powder_manufacturing_plant_project_report.pdfIn PDF document text
    • http://toraxetutat.epizy.com/46684204904.pdfIn PDF document text
    • http://tinatuvarisofat.epizy.com/buxaru.pdfIn PDF document text
    • http://dajizipazubeva.epizy.com/magazine_design_guide.pdfIn PDF document text
    • https://3a5aa097-47f9-475f-9992-83bceef25cc3.filesusr.com/ugd/f55bec_01a7b53aeab64f1f8d9a3a325c1ca95a.pdf?index=trueIn PDF document text
    • https://98350ace-7ac4-4f38-a9d9-579fdad8050b.filesusr.com/ugd/9b2d9b_91580b8d8e184195adf271165dbfa99d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gumegulaxi/458320485.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/formato_carta_apertura_de_cuenta_nomina_bancolombia.pdfIn PDF document text
    • http://pefimubis.myartsonline.com/onkyo_tx-nr609_arc_setup.pdfIn PDF document text
    • http://tajafex.rf.gd/good_academic_performance_meaning.pdfIn PDF document text
    • http://lizugerij.epizy.com/xivura.pdfIn PDF document text
    • https://78bdfa25-736e-4945-a764-db21511aacb9.filesusr.com/ugd/9bd82e_2a71fd0c2a704a798009409aabf082ba.pdf?index=trueIn PDF document text
    • https://7f993087-45f6-41f4-96e5-9dcaca18fb91.filesusr.com/ugd/9a92dd_92ec9fbd12a24e2e9063e383dfee5713.pdf?index=trueIn PDF document text
    • https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_661bc04da6fb4371986e10be0ab8f530.pdf?index=trueIn PDF document text
    • http://luvabokinoleg.onlinewebshop.net/zorba_the_greek_book_critical_analysis.pdfIn PDF document text
    • https://f1ddcea9-c323-452c-a4d3-aaefec61e50a.filesusr.com/ugd/defd8a_0e55dcccea2f4e109767eeb29cf374bb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wikurixobelu/90544186562.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0A6 5868 bytes
SHA-256: d85e667de1f5ca56b3b5deafb11d28bee745d8f1c56bf79fb31fc8ee696fe392
font_01_sfnt_off0000e4ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AB 9536 bytes
SHA-256: e0288dd7abc0e7713ae632878df9346bc235647a899ec801e1b64d511246b02c

Open this report in the interactive analyzer, or submit your own file for analysis.