Malicious PDF — malware analysis report

Static analysis result for SHA-256 b00decd4787d3efb…

MALICIOUS

PDF

84.2 KB Created: 2020-11-23 05:54:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-01-23
MD5: a2955d38c28bda16a2324beb556917a5 SHA-1: 4a4bc3f28fd81c3f0f30c99730d77379be7cd375 SHA-256: b00decd4787d3efb00b8780f992fe08189daecf253c8c1b43c86280b983f9483
254 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=musa+winx+club+enchantix In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365546/normal_5f871c9522480.pdfIn PDF document text
    • https://nokipudejavuf.weebly.com/uploads/1/3/4/4/134486619/f0e3a78.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382004/normal_5f93099078019.pdfIn PDF document text
    • https://gugozakeku.weebly.com/uploads/1/3/4/5/134588211/gamog.pdfIn PDF document text
    • https://pesonukakevu.weebly.com/uploads/1/3/4/8/134863065/9efd06a.pdfIn PDF document text
    • https://zadujemerumid.weebly.com/uploads/1/3/2/6/132695269/virif-kuwelu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/05144820-1c74-4713-9512-a068ac9e04a4/37566009657.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/beauty_from_the_inside_out_bobbi_brown.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93114336-7c35-43b7-8e6f-37b3be6c9767/tatli_kopek_cinsleri.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cce4d69a-3217-49a6-ae56-08fa96739390/56286167861.pdfIn PDF document text
    • https://s3.amazonaws.com/zedudo/como_hacer_carta_de_verificacion_de_empleo.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/haynes_manual_coupon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68e3874d-9fe7-4eb7-8f4b-85c407a5be52/36023312691.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2950eb2b-05ad-44c0-a7a6-af6c101e1e1d/92928533038.pdfIn PDF document text
    • https://s3.amazonaws.com/nazekisigiduz/wesapejukoloforifeletumo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B2 4868 bytes
SHA-256: 85ef48e8b6b80e9b1515a2ad04e15d144be8ad9920ea996f218525fe7c0b55cd
font_01_sfnt_off00010647.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10647 3720 bytes
SHA-256: 40ef96da86b6123d577d475be460de15c41b9ca7393a8e650be4e9942aa3c64b
font_02_sfnt_off000111a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111A9 10680 bytes
SHA-256: 2ee603d098f7afd9622d6543c3633d0820a76151bec35f529c48ad5b61e75cbd
font_03_sfnt_off000135a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x135A9 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.