Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0ec531c3aac408c…

MALICIOUS

PDF

44.8 KB Created: 2020-10-25 11:44:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25
MD5: 1f234119a31c8d5712e4bb60600c08ff SHA-1: 7b1de6248c7a6d97f7a7a06802e916c138a7e9bc SHA-256: c0ec531c3aac408cc239fd4a2f20c305759d5a6df9a061622852180a5372d31e
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=literary+devices+worksheet+grade+8 In PDF document text
    • https://rojusonevupa.weebly.com/uploads/1/3/0/8/130814232/tozewekugodakoto.pdfIn PDF document text
    • https://loponulofaxoli.weebly.com/uploads/1/3/4/3/134324484/tojugabewave.pdfIn PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/4765241.pdfIn PDF document text
    • https://relulime.weebly.com/uploads/1/3/4/3/134384492/6fa29.pdfIn PDF document text
    • https://wozuwonasanava.weebly.com/uploads/1/3/1/4/131483955/1524810.pdfIn PDF document text
    • https://kilutiwoxit.weebly.com/uploads/1/3/1/6/131636983/fitadotanasokob.pdfIn PDF document text
    • https://xabopefasuliwik.weebly.com/uploads/1/3/4/4/134445681/5004247.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/memul/wewisirovakunav.pdfIn PDF document text
    • https://s3.amazonaws.com/niporofez/94985774760.pdfIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/39419003718.pdfIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/66341841489.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c86478f-6bbd-4c55-8a0f-1a4ff694d7d1/46541214177.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bd249b2-60fa-4fb3-81d8-09260294e54d/importancia_de_la_contabilidad_en_la_administracion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/263aa952-6f25-4804-b2ca-f337f6194771/25397103667.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc54922a-69b8-4969-b645-2350a5b4148d/88939576981.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ceadd75-19b6-4748-aea9-f2d0eb7d4e20/kilujej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cd2a94c-484a-48ba-8e8d-6ff055780974/612479440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a5e7dd0-4ff5-4e74-9c9f-30e8d7fc00ca/sufivagarovop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9bd7842-1644-452f-8aa9-cea1ab30432c/lukesuvapudus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d391a366-826d-4377-bd2b-1135683bb722/sememotezizuvepevolopi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b52773c0-d605-4fb9-a05a-4a25105d8857/50375997573.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D9F 5624 bytes
SHA-256: b29b7c271fa63f8f092f1252431840a36b5f5c3286ce978479cb28d7a2c0afab
font_01_sfnt_off000080d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80D7 11552 bytes
SHA-256: 6a865a5ff5208bb4630d5e58618ffff1469e6aad4e1aace08f266867ff47fba5

Open this report in the interactive analyzer, or submit your own file for analysis.