Malicious PDF — malware analysis report

Static analysis result for SHA-256 b723f84157c6cfd4…

MALICIOUS

PDF

47.5 KB Created: 2020-10-19 04:45:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: ce24d0718131b94b2e7b83dbcdfd301f SHA-1: fe9c886478017498c42bdd0e1370d48eee4deafb SHA-256: b723f84157c6cfd439bbce4f3c3e4847690d634ea6cd7842a5c68fd82cae60fb
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=audio+mixer+cutter+apk In PDF document text
    • https://cdn-cms.f-static.net/uploads/4376101/normal_5f8b90518dbfa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365642/normal_5f876d4750ee4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380214/normal_5f8cb64f0f966.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365580/normal_5f874e30c5e16.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366362/normal_5f8c53fb1a055.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377120/normal_5f8bbe63e900c.pdfIn PDF document text
    • https://xexovelez.weebly.com/uploads/1/3/0/8/130813416/3242869.pdfIn PDF document text
    • https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/ff06dfdf.pdfIn PDF document text
    • https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/dotejixalawowu-marefo-zufok-magaduviluka.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369777/normal_5f886c605d41d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373757/normal_5f8a324fe7b84.pdfIn PDF document text
    • https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/059d55fbff3.pdfIn PDF document text
    • https://suganolorifumu.weebly.com/uploads/1/3/0/8/130814011/mofuwonakoj-gugimugepadozub-sunena.pdfIn PDF document text
    • https://rakamukomegu.weebly.com/uploads/1/3/2/6/132681656/ruzevemibuwo-rugezigamivo-jikujiviruxe-suxubamitu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc5c20da-d0d3-4317-a1f6-4d5ceb5ab579/lozifo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f61f91e-1511-4213-98ae-2255781b184f/1240116664.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95d2499b-3aac-47ac-9fc0-a58669dad722/18880463762.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006734.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6734 5132 bytes
SHA-256: 32938187210a6db4ad2a99032829f4a7537d8f4fa777a8bd72d7efb8acc374b7
font_01_sfnt_off00007892.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7892 10256 bytes
SHA-256: 5979ed8e3cd2e63448d45ac866887630b95b67ef6ad9fa64b2c76f53666195bf
font_02_sfnt_off00009bef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BEF 16232 bytes
SHA-256: cc032a1d7efe9f52c63bdca4360dad9aff78fb14a47167d9e0089e6cc9416013

Open this report in the interactive analyzer, or submit your own file for analysis.