PDF malware analysis — malicious · d079c4dfac15d66f

MALICIOUS

PDF

54.5 KB Created: 2020-10-19 15:26:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-15

MD5: a32cdd2b3fed49a3e25f8f5d011e8638 SHA-1: f3b4f1e8756cece545272035c2086e2d3ecf380a SHA-256: d079c4dfac15d66fa1d9febe1864512d90f51f6e5ace3680a482c0629189cfda

184 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/123?keyword=component+form+of+a+vector+worksheet In PDF document text
- https://cdn-cms.f-static.net/uploads/4379045/normal_5f8cf36428582.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f8c1d407b7fb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370278/normal_5f881611bf938.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384832/normal_5f8cbf8d2f363.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387938/normal_5f8d1ad73835b.pdfIn PDF document text
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/belapigojat.pdfIn PDF document text
- https://derodaju.weebly.com/uploads/1/3/1/6/131606282/rimaw_bokagov_peviboxaxupan_toneketune.pdfIn PDF document text
- https://xivenisulebitok.weebly.com/uploads/1/3/1/3/131378814/e47cf67.pdfIn PDF document text
- https://jowodetuleguzu.weebly.com/uploads/1/3/1/8/131856173/pajuxeramavuzap.pdfIn PDF document text
- https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/surarebekiso.pdfIn PDF document text
- https://mijisurux.weebly.com/uploads/1/3/1/0/131070147/502577.pdfIn PDF document text
- https://segakimorepej.weebly.com/uploads/1/3/0/7/130738797/4362893.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/976f4811-f703-41ad-b401-c5ba796422e3/56798448326.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb08e8ac-3b2f-47d1-a021-15f86e7ce82b/citroen_c8_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d48ed16-4121-43bf-8a51-531a66b3f173/mibew.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b27709c-c794-425a-97f5-5b191701fbaa/ronevelisaxiduwu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f3ea1711-4de7-40e3-9c12-da0ac1872d7e/66566116315.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e34b7c46-4020-43d6-9557-566d543d39d3/38315657443.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f881bb8f-df4d-4c58-8337-5666f864387a/35951082960.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0478/4947/2159/files/gsm_modem_at_commands.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0493/0391/2607/files/92396344597.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0495/6310/7480/files/eternium_latest_mod_apk_download.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0484/8972/6107/files/7711577461.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007f95.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F95	5344 bytes
SHA-256: `1d5071e8faafee0b6e361bde9377980af6324b7622e80337a7b917ea841f92b6`
`font_01_sfnt_off000091ac.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x91AC	10832 bytes
SHA-256: `b28f4addf2abd0df89872dd4a4f898e203c1851f4538784acdf35b903a227bbb`
`font_02_sfnt_off0000b6bd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB6BD	16116 bytes
SHA-256: `757edbe9ca696dc752e8794cc2fab55b744a24b197aba41abea0c8f583a0f3ca`

Open this report in the interactive analyzer, or submit your own file for analysis.