Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9de20ce79396404…

MALICIOUS

PDF

43.2 KB Created: 2020-10-25 20:06:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-25
MD5: f3476a02e5b2dddf94750e57e645b886 SHA-1: 69c5586d74f7def80af68bd5fe8118cebada6f89 SHA-256: c9de20ce79396404334c41ead77555d08113ddae80af1f76341d93f1fa0cf1be
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=critical+theory+today+lois+tyson+pdf In PDF document text
    • https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/1302795.pdfIn PDF document text
    • https://vodexekuteb.weebly.com/uploads/1/3/0/7/130776001/tinibej_losafiropi.pdfIn PDF document text
    • https://senobatupubem.weebly.com/uploads/1/3/1/4/131437889/5970746.pdfIn PDF document text
    • https://vegilirebaj.weebly.com/uploads/1/3/1/0/131070576/8876174.pdfIn PDF document text
    • https://rakamukomegu.weebly.com/uploads/1/3/2/6/132681656/9808069.pdfIn PDF document text
    • https://rosofofupamufi.weebly.com/uploads/1/3/4/3/134364257/mizolivofulu.pdfIn PDF document text
    • https://bakigimos.weebly.com/uploads/1/3/4/3/134322269/395dce4b0.pdfIn PDF document text
    • https://kubupukadumu.weebly.com/uploads/1/3/1/3/131382740/wefojeze_kesinaduriza_fivoresem.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0476/9339/8182/files/xibusufitesedoperolotedef.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/4093/7896/files/ver_contrasea_wifi_apk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/6249/2324/files/sufunizoti.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0495/9027/2152/files/pencil_grip_development.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4351/1706/files/airbrush_body_paint_spray_gun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9179dab-4f6d-437b-bbff-762818d2d59d/wumewazuxozojaju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d613d90-6e8e-4ce8-8dbb-89d8da1095ff/kiviviwejetegupakemuboda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd65b0df-034c-4ccf-a25b-d66d055f364b/monster_hunter_world_lance_vs_gunlance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5e59e24-a7a1-42db-9bfe-2eccd806048c/lonejededali.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/4969/6418/files/14019614348.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/8650/1806/files/insulin_resistance_thesis.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/7090/5750/files/pawigezofi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/3114/1783/files/guzavijeke.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/4488/1059/files/86930836644.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68FF 5248 bytes
SHA-256: 40b0d7f82ac1c98684364513824fa46527a41529d998667d75913ebfb1f9d904
font_01_sfnt_off00007ad0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AD0 10912 bytes
SHA-256: 2dfb2c6c4d9cb66fba8256cca4925ddd56c4fccc6f3cc773cf0a6584e2cb1514

Open this report in the interactive analyzer, or submit your own file for analysis.