Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3a9fd6e96ccb747…

MALICIOUS

PDF

50.0 KB Created: 2020-10-04 22:32:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15
MD5: d9f0ab7feb5481dc85ad595b8b828328 SHA-1: be41d180061bb335ff4355fbc13ad54d95b50fa8 SHA-256: c3a9fd6e96ccb747acec5c0bac1078369ebe99d6f52a237d92c05896609fdb88
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/pify?keyword=the+impossible+knife+of+memory In PDF document text
    • http://rogomamo.cutterhq.com/uploads/1/3/1/4/131406286/sarak-zijiguliku-lafabuxo-rofame.pdfIn PDF document text
    • http://files.benstillsings.com/uploads/1/3/1/4/131437157/tifosajenagike_tekojiwatepen_bevufewub.pdfIn PDF document text
    • http://buximog.mrsapedersen.com/uploads/1/3/2/6/132681737/64f8aeb8.pdfIn PDF document text
    • http://files.aquabellylakelanier.com/uploads/1/3/1/4/131482819/170fc2e6a258af.pdfIn PDF document text
    • http://files.ldceny.net/uploads/1/3/0/7/130775221/januf-fopigilu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cc7a235-1259-4f7d-b6af-1c20214c523e/85614330315.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f7fa650-6400-4e7d-95ea-2db15d8c1202/duvewemi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f435c122-0cd5-411f-b7bb-9337aacf8130/duburejiju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1a6ff9e-3df4-4f2f-b173-d4c0eec5707f/90122943891.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db703944-8bbe-4c5c-a9cd-fea66670649c/pojamabelopamagedi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ae51e51-32fd-4c2c-b90e-6761ec926024/dozusimob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/672101bf-2e01-4a1c-bc9e-b4de044b7b71/vuderimafawabipud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d60b804-5f22-4820-92e5-e91e1b0692f3/63846791628.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/3654/9018/files/13282011872.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/5801/5637/files/26926002488.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/4143/6060/files/femifebavesuraredogivelos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008602.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8602 5188 bytes
SHA-256: 436675527ade5f31217acba716a1a3a3202d559e815bb75060edb7742ff6cd8b
font_01_sfnt_off00009782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9782 10424 bytes
SHA-256: cbfa102e34883abeb71a44069b3ccd95419164254701b54aea36bb3386d92f22

Open this report in the interactive analyzer, or submit your own file for analysis.