Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce89b3323dd69cc9…

MALICIOUS

PDF

43.2 KB Created: 2020-10-09 22:54:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 0311db9c8e10ad4d3a1b6d75c9fc7f00 SHA-1: bc52f0b5c5295fc6d69b09811360cd20b3a46c47 SHA-256: ce89b3323dd69cc9616dc24a1eec6f063a5a6a1aeef7a7038729ee9e06a5d253
202 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=tinyumbrella+64+bit+windows+7 In PDF document text
    • http://zafake.bettereatingcoach.com/uploads/1/3/1/4/131438477/damutozigiba-kukuno.pdfIn PDF document text
    • http://gofanavej.ecmjwedding.com/uploads/1/3/1/1/131163744/2827180.pdfIn PDF document text
    • http://files.worldyouthpeaceforum.com/uploads/1/3/1/4/131453253/8ac3794.pdfIn PDF document text
    • http://xozota.rwjbhinstructors.com/uploads/1/3/1/4/131453934/xelejeko.pdfIn PDF document text
    • http://files.cowponies1969.com/uploads/1/3/1/0/131071137/cf48f1005770.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e479a14-b1f6-49d6-bc8a-159ba4eb54c7/76911794098.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5dec391-8193-4339-a19b-667f6213ea00/29910814015.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64452842-0bca-49e3-87a5-9eca31cc93c2/79652736757.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81b9d566-4b86-4f3b-bb92-b895cc41433d/sujuvifekozigejadufinu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fa13e12-5d8c-4e44-b055-0b0391f0e1b5/40035747513.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fc2b3ca-c918-4e35-a83c-4c2971ec178b/7204199301.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/1544/1054/files/zumotujozugosufeviruxaji.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/2754/9338/files/16828163997.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/2191/7086/files/4l80e_transmission_service_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/7003/0492/files/gnomoria_starting_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000662c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x662C 5576 bytes
SHA-256: 40eae0ef1fbf535576abc89cb576dfd7936c3def47a9286e9c0e96b8979e545a
font_01_sfnt_off00007927.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7927 11956 bytes
SHA-256: 6a12ab5a4622be6e6bc7d077ebc6d8ccaa6e782bd7c74fdd45c9a87d17d1c080

Open this report in the interactive analyzer, or submit your own file for analysis.